Index: /trunk/include/VBox/vmm/iom.h
===================================================================
--- /trunk/include/VBox/vmm/iom.h	(revision 82312)
+++ /trunk/include/VBox/vmm/iom.h	(revision 82313)
@@ -457,8 +457,4 @@
 VMMDECL(VBOXSTRICTRC)   IOMMMIORead(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, uint32_t *pu32Value, size_t cbValue);
 VMMDECL(VBOXSTRICTRC)   IOMMMIOWrite(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, uint32_t u32Value, size_t cbValue);
-/*VMMDECL(int)            IOMMMIOMapMMIO2Page(PVMCC pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysRemapped, uint64_t fPageFlags);*/
-/*VMMDECL(int)            IOMMMIOMapMMIOHCPage(PVMCC pVM, PVMCPUCC pVCpu, RTGCPHYS GCPhys, RTHCPHYS HCPhys, uint64_t fPageFlags); - not used any more */
-/*VMMDECL(int)            IOMMMIOResetRegion(PVMCC pVM, RTGCPHYS GCPhys);*/
-
 VMM_INT_DECL(VBOXSTRICTRC) IOMR0MmioPhysHandler(PVMCC pVM, PVMCPUCC pVCpu, uint32_t uErrorCode, RTGCPHYS GCPhysFault);
 VMMDECL(int)            IOMMmioMapMmio2Page(PVMCC pVM, PPDMDEVINS pDevIns, IOMMMIOHANDLE hRegion, RTGCPHYS offRegion,
@@ -504,34 +500,8 @@
 VMMR3_INT_DECL(RTGCPHYS) IOMR3MmioGetMappingAddress(PVM pVM, PPDMDEVINS pDevIns, IOMMMIOHANDLE hRegion);
 
-/** @name obsolete
- * @deprecated
- * @{ */
-VMMR3_INT_DECL(int)  IOMR3MmioRegisterR3(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTHCPTR pvUser,
-                                         R3PTRTYPE(PFNIOMMMIOWRITE) pfnWriteCallback,
-                                         R3PTRTYPE(PFNIOMMMIOREAD)  pfnReadCallback,
-                                         R3PTRTYPE(PFNIOMMMIOFILL)  pfnFillCallback,
-                                         uint32_t fFlags, const char *pszDesc);
-VMMR3_INT_DECL(int)  IOMR3MmioRegisterR0(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTR0PTR pvUser,
-                                         R0PTRTYPE(PFNIOMMMIOWRITE) pfnWriteCallback,
-                                         R0PTRTYPE(PFNIOMMMIOREAD)  pfnReadCallback,
-                                         R0PTRTYPE(PFNIOMMMIOFILL)  pfnFillCallback);
-#if 0
-VMMR3_INT_DECL(int)  IOMR3MmioRegisterRC(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTGCPTR pvUser,
-                                         RCPTRTYPE(PFNIOMMMIOWRITE) pfnWriteCallback,
-                                         RCPTRTYPE(PFNIOMMMIOREAD)  pfnReadCallback,
-                                         RCPTRTYPE(PFNIOMMMIOFILL)  pfnFillCallback);
-#endif
-VMMR3_INT_DECL(int)  IOMR3MmioDeregister(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange);
-VMMR3_INT_DECL(int)  IOMR3MmioExNotifyMapped(PVM pVM, void *pvUser, RTGCPHYS GCPhys);
-VMMR3_INT_DECL(void) IOMR3MmioExNotifyUnmapped(PVM pVM, void *pvUser, RTGCPHYS GCPhys);
-VMMR3_INT_DECL(void) IOMR3MmioExNotifyDeregistered(PVM pVM, void *pvUser);
-
-/** @} */
-
 VMMR3_INT_DECL(VBOXSTRICTRC) IOMR3ProcessForceFlag(PVM pVM, PVMCPU pVCpu, VBOXSTRICTRC rcStrict);
 
 VMMR3_INT_DECL(void) IOMR3NotifyBreakpointCountChange(PVM pVM, bool fPortIo, bool fMmio);
 VMMR3_INT_DECL(void) IOMR3NotifyDebugEventChange(PVM pVM, DBGFEVENT enmEvent, bool fEnabled);
-
 /** @} */
 #endif /* IN_RING3 */
Index: /trunk/include/VBox/vmm/pdmdev.h
===================================================================
--- /trunk/include/VBox/vmm/pdmdev.h	(revision 82312)
+++ /trunk/include/VBox/vmm/pdmdev.h	(revision 82313)
@@ -1975,5 +1975,5 @@
 
 /** Current PDMDEVHLPR3 version number. */
-#define PDM_DEVHLPR3_VERSION                    PDM_VERSION_MAKE_PP(0xffe7, 39, 0)
+#define PDM_DEVHLPR3_VERSION                    PDM_VERSION_MAKE_PP(0xffe7, 40, 0)
 
 /**
@@ -2154,86 +2154,4 @@
     DECLR3CALLBACKMEMBER(RTGCPHYS, pfnMmioGetMappingAddress,(PPDMDEVINS pDevIns, IOMMMIOHANDLE hRegion));
     /** @} */
-
-    /**
-     * Register a Memory Mapped I/O (MMIO) region.
-     *
-     * These callbacks are of course for the ring-3 context (R3). Register HC
-     * handlers before raw-mode context (RC) and ring-0 context (R0) handlers! There
-     * must be a R3 handler for every RC and R0 handler!
-     *
-     * @returns VBox status.
-     * @param   pDevIns             The device instance to register the MMIO with.
-     * @param   GCPhysStart         First physical address in the range.
-     * @param   cbRange             The size of the range (in bytes).
-     * @param   pvUser              User argument.
-     * @param   pfnWrite            Pointer to function which is gonna handle Write operations.
-     * @param   pfnRead             Pointer to function which is gonna handle Read operations.
-     * @param   pfnFill             Pointer to function which is gonna handle Fill/memset operations. (optional)
-     * @param   fFlags              Flags, IOMMMIO_FLAGS_XXX.
-     * @param   pszDesc             Pointer to description string. This must not be freed.
-     * @remarks Caller enters the device critical section prior to invoking the
-     *          registered callback methods.
-     * @deprecated
-     */
-    DECLR3CALLBACKMEMBER(int, pfnMMIORegister,(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTHCPTR pvUser,
-                                               PFNIOMMMIOWRITE pfnWrite, PFNIOMMMIOREAD pfnRead, PFNIOMMMIOFILL pfnFill,
-                                               uint32_t fFlags, const char *pszDesc));
-
-    /**
-     * Register a Memory Mapped I/O (MMIO) region for RC.
-     *
-     * These callbacks are for the raw-mode context (RC). Register ring-3 context
-     * (R3) handlers before guest context handlers! There must be a R3 handler for
-     * every RC handler!
-     *
-     * @returns VBox status.
-     * @param   pDevIns             The device instance to register the MMIO with.
-     * @param   GCPhysStart         First physical address in the range.
-     * @param   cbRange             The size of the range (in bytes).
-     * @param   pvUser              User argument.
-     * @param   pszWrite            Name of the RC function which is gonna handle Write operations.
-     * @param   pszRead             Name of the RC function which is gonna handle Read operations.
-     * @param   pszFill             Name of the RC function which is gonna handle Fill/memset operations. (optional)
-     * @remarks Caller enters the device critical section prior to invoking the
-     *          registered callback methods.
-     * @deprecated
-     */
-    DECLR3CALLBACKMEMBER(int, pfnMMIORegisterRC,(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTRCPTR pvUser,
-                                                 const char *pszWrite, const char *pszRead, const char *pszFill));
-
-    /**
-     * Register a Memory Mapped I/O (MMIO) region for R0.
-     *
-     * These callbacks are for the ring-0 host context (R0).  Register ring-3
-     * constext (R3) handlers before R0 handlers!  There must be a R3 handler for
-     * every R0 handler!
-     *
-     * @returns VBox status.
-     * @param   pDevIns             The device instance to register the MMIO with.
-     * @param   GCPhysStart         First physical address in the range.
-     * @param   cbRange             The size of the range (in bytes).
-     * @param   pvUser              User argument. (if pointer, then it must be in locked memory!)
-     * @param   pszWrite            Name of the RC function which is gonna handle Write operations.
-     * @param   pszRead             Name of the RC function which is gonna handle Read operations.
-     * @param   pszFill             Name of the RC function which is gonna handle Fill/memset operations. (optional)
-     * @remarks Caller enters the device critical section prior to invoking the
-     *          registered callback methods.
-     * @deprecated
-     */
-    DECLR3CALLBACKMEMBER(int, pfnMMIORegisterR0,(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTR0PTR pvUser,
-                                                 const char *pszWrite, const char *pszRead, const char *pszFill));
-
-    /**
-     * Deregister a Memory Mapped I/O (MMIO) region.
-     *
-     * This naturally affects both guest context (GC), ring-0 (R0) and ring-3 (R3/HC) handlers.
-     *
-     * @returns VBox status.
-     * @param   pDevIns             The device instance owning the MMIO region(s).
-     * @param   GCPhysStart         First physical address in the range.
-     * @param   cbRange             The size of the range (in bytes).
-     * @deprecated
-     */
-    DECLR3CALLBACKMEMBER(int, pfnMMIODeregister,(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange));
 
     /** @name MMIO2
@@ -5733,109 +5651,4 @@
 
 /**
- * Register a Memory Mapped I/O (MMIO) region.
- *
- * These callbacks are of course for the ring-3 context (R3). Register HC
- * handlers before raw-mode context (RC) and ring-0 context (R0) handlers! There
- * must be a R3 handler for every RC and R0 handler!
- *
- * @returns VBox status.
- * @param   pDevIns             The device instance to register the MMIO with.
- * @param   GCPhysStart         First physical address in the range.
- * @param   cbRange             The size of the range (in bytes).
- * @param   pvUser              User argument.
- * @param   fFlags              Flags, IOMMMIO_FLAGS_XXX.
- * @param   pfnWrite            Pointer to function which is gonna handle Write operations.
- * @param   pfnRead             Pointer to function which is gonna handle Read operations.
- * @param   pszDesc             Pointer to description string. This must not be freed.
- */
-DECLINLINE(int) PDMDevHlpMMIORegister(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTHCPTR pvUser,
-                                      uint32_t fFlags, PFNIOMMMIOWRITE pfnWrite, PFNIOMMMIOREAD pfnRead, const char *pszDesc)
-{
-    return pDevIns->pHlpR3->pfnMMIORegister(pDevIns, GCPhysStart, cbRange, pvUser, pfnWrite, pfnRead, NULL /*pfnFill*/,
-                                            fFlags, pszDesc);
-}
-
-/**
- * Register a Memory Mapped I/O (MMIO) region for RC.
- *
- * These callbacks are for the raw-mode context (RC). Register ring-3 context
- * (R3) handlers before guest context handlers! There must be a R3 handler for
- * every RC handler!
- *
- * @returns VBox status.
- * @param   pDevIns             The device instance to register the MMIO with.
- * @param   GCPhysStart         First physical address in the range.
- * @param   cbRange             The size of the range (in bytes).
- * @param   pvUser              User argument.
- * @param   pszWrite            Name of the RC function which is gonna handle Write operations.
- * @param   pszRead             Name of the RC function which is gonna handle Read operations.
- */
-DECLINLINE(int) PDMDevHlpMMIORegisterRC(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTRCPTR pvUser,
-                                        const char *pszWrite, const char *pszRead)
-{
-    return pDevIns->pHlpR3->pfnMMIORegisterRC(pDevIns, GCPhysStart, cbRange, pvUser, pszWrite, pszRead, NULL /*pszFill*/);
-}
-
-/**
- * Register a Memory Mapped I/O (MMIO) region for R0.
- *
- * These callbacks are for the ring-0 host context (R0).  Register ring-3
- * constext (R3) handlers before R0 handlers!  There must be a R3 handler for
- * every R0 handler!
- *
- * @returns VBox status.
- * @param   pDevIns             The device instance to register the MMIO with.
- * @param   GCPhysStart         First physical address in the range.
- * @param   cbRange             The size of the range (in bytes).
- * @param   pvUser              User argument. (if pointer, then it must be in locked memory!)
- * @param   pszWrite            Name of the RC function which is gonna handle Write operations.
- * @param   pszRead             Name of the RC function which is gonna handle Read operations.
- * @remarks Caller enters the device critical section prior to invoking the
- *          registered callback methods.
- */
-DECLINLINE(int) PDMDevHlpMMIORegisterR0(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTR0PTR pvUser,
-                                        const char *pszWrite, const char *pszRead)
-{
-    return pDevIns->pHlpR3->pfnMMIORegisterR0(pDevIns, GCPhysStart, cbRange, pvUser, pszWrite, pszRead, NULL /*pszFill*/);
-}
-
-/**
- * @copydoc PDMDEVHLPR3::pfnMMIORegister
- */
-DECLINLINE(int) PDMDevHlpMMIORegisterEx(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTHCPTR pvUser,
-                                        uint32_t fFlags, PFNIOMMMIOWRITE pfnWrite, PFNIOMMMIOREAD pfnRead,
-                                        PFNIOMMMIOFILL pfnFill, const char *pszDesc)
-{
-    return pDevIns->pHlpR3->pfnMMIORegister(pDevIns, GCPhysStart, cbRange, pvUser, pfnWrite, pfnRead, pfnFill,
-                                            fFlags, pszDesc);
-}
-
-/**
- * @copydoc PDMDEVHLPR3::pfnMMIORegisterRC
- */
-DECLINLINE(int) PDMDevHlpMMIORegisterRCEx(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTRCPTR pvUser,
-                                          const char *pszWrite, const char *pszRead, const char *pszFill)
-{
-    return pDevIns->pHlpR3->pfnMMIORegisterRC(pDevIns, GCPhysStart, cbRange, pvUser, pszWrite, pszRead, pszFill);
-}
-
-/**
- * @copydoc PDMDEVHLPR3::pfnMMIORegisterR0
- */
-DECLINLINE(int) PDMDevHlpMMIORegisterR0Ex(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTR0PTR pvUser,
-                                          const char *pszWrite, const char *pszRead, const char *pszFill)
-{
-    return pDevIns->pHlpR3->pfnMMIORegisterR0(pDevIns, GCPhysStart, cbRange, pvUser, pszWrite, pszRead, pszFill);
-}
-
-/**
- * @copydoc PDMDEVHLPR3::pfnMMIODeregister
- */
-DECLINLINE(int) PDMDevHlpMMIODeregister(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange)
-{
-    return pDevIns->pHlpR3->pfnMMIODeregister(pDevIns, GCPhysStart, cbRange);
-}
-
-/**
  * @copydoc PDMDEVHLPR3::pfnMmio2Create
  */
Index: /trunk/src/VBox/Devices/Bus/DevPciIch9.cpp
===================================================================
--- /trunk/src/VBox/Devices/Bus/DevPciIch9.cpp	(revision 82312)
+++ /trunk/src/VBox/Devices/Bus/DevPciIch9.cpp	(revision 82313)
@@ -2512,9 +2512,8 @@
  *
  * @returns VBox status code.
- * @param   pDevIns             The PCI bus device instance.
  * @param   pDev                The PCI device.
  * @param   iRegion             The region to unmap.
  */
-static int devpciR3UnmapRegion(PPDMDEVINS pDevIns, PPDMPCIDEV pDev, int iRegion)
+static int devpciR3UnmapRegion(PPDMPCIDEV pDev, int iRegion)
 {
     PPCIIOREGION pRegion = &pDev->Int.s.aIORegions[iRegion];
@@ -2524,63 +2523,38 @@
     if (pRegion->addr != INVALID_PCI_ADDRESS)
     {
-        if (   (pRegion->hHandle != UINT64_MAX)
-            || (pRegion->fFlags & PDMPCIDEV_IORGN_F_NEW_STYLE))
-        {
-            /*
-             * New style device with a IOM handle.  Do callout first (optional),
-             * then do the unmapping via handle.
-             */
-            if (pRegion->pfnMap)
-            {
-                rc = pRegion->pfnMap(pDev->Int.s.pDevInsR3, pDev, iRegion,
-                                     NIL_RTGCPHYS, pRegion->size, (PCIADDRESSSPACE)(pRegion->type));
+        /*
+         * Do callout first (optional), then do the unmapping via handle if we've been handed one.
+         */
+        if (pRegion->pfnMap)
+        {
+            rc = pRegion->pfnMap(pDev->Int.s.pDevInsR3, pDev, iRegion,
+                                 NIL_RTGCPHYS, pRegion->size, (PCIADDRESSSPACE)(pRegion->type));
+            AssertRC(rc);
+        }
+
+        switch (pRegion->fFlags & PDMPCIDEV_IORGN_F_HANDLE_MASK)
+        {
+            case PDMPCIDEV_IORGN_F_IOPORT_HANDLE:
+                rc = PDMDevHlpIoPortUnmap(pDev->Int.s.pDevInsR3, (IOMIOPORTHANDLE)pRegion->hHandle);
                 AssertRC(rc);
-            }
-
-            switch (pRegion->fFlags & PDMPCIDEV_IORGN_F_HANDLE_MASK)
-            {
-                case PDMPCIDEV_IORGN_F_IOPORT_HANDLE:
-                    rc = PDMDevHlpIoPortUnmap(pDev->Int.s.pDevInsR3, (IOMIOPORTHANDLE)pRegion->hHandle);
-                    AssertRC(rc);
-                    break;
-
-                case PDMPCIDEV_IORGN_F_MMIO_HANDLE:
-                    rc = PDMDevHlpMmioUnmap(pDev->Int.s.pDevInsR3, (IOMMMIOHANDLE)pRegion->hHandle);
-                    AssertRC(rc);
-                    break;
-
-                case PDMPCIDEV_IORGN_F_MMIO2_HANDLE:
-                    rc = PDMDevHlpMmio2Unmap(pDev->Int.s.pDevInsR3, (PGMMMIO2HANDLE)pRegion->hHandle);
-                    AssertRC(rc);
-                    break;
-
-                case PDMPCIDEV_IORGN_F_NO_HANDLE:
-                    Assert(pRegion->fFlags & PDMPCIDEV_IORGN_F_NEW_STYLE);
-                    Assert(pRegion->hHandle == UINT64_MAX);
-                    break;
-
-                default:
-                    AssertLogRelFailed();
-            }
-        }
-        else
-        {
-            /*
-             * Old style device, no handle here and only MMIOEx gets callouts.
-             */
-            if (pRegion->type & PCI_ADDRESS_SPACE_IO)
-                AssertFailed();
-            else
-            {
-                RTGCPHYS     GCPhysBase = pRegion->addr;
-#ifdef VBOX_STRICT
-                PDEVPCIBUSCC pBusCC     = PDMINS_2_DATA_CC(pDevIns, PDEVPCIBUSCC);
-                Assert(!pBusCC->pPciHlpR3->pfnIsMMIOExBase(pDevIns, pDev->Int.s.pDevInsR3, GCPhysBase));
-#else
-                RT_NOREF(pDevIns);
-#endif
-                rc = PDMDevHlpMMIODeregister(pDev->Int.s.pDevInsR3, GCPhysBase, pRegion->size);
+                break;
+
+            case PDMPCIDEV_IORGN_F_MMIO_HANDLE:
+                rc = PDMDevHlpMmioUnmap(pDev->Int.s.pDevInsR3, (IOMMMIOHANDLE)pRegion->hHandle);
                 AssertRC(rc);
-            }
+                break;
+
+            case PDMPCIDEV_IORGN_F_MMIO2_HANDLE:
+                rc = PDMDevHlpMmio2Unmap(pDev->Int.s.pDevInsR3, (PGMMMIO2HANDLE)pRegion->hHandle);
+                AssertRC(rc);
+                break;
+
+            case PDMPCIDEV_IORGN_F_NO_HANDLE:
+                Assert(pRegion->fFlags & PDMPCIDEV_IORGN_F_NEW_STYLE);
+                Assert(pRegion->hHandle == UINT64_MAX);
+                break;
+
+            default:
+                AssertLogRelFailed();
         }
         pRegion->addr = INVALID_PCI_ADDRESS;
@@ -2594,9 +2568,8 @@
  *
  * @returns VINF_SUCCESS of DBGFSTOP result.
- * @param   pDevIns             The PCI bus device instance.
  * @param   pPciDev             The PCI device to update the mappings for.
  * @param   fP2PBridge          Whether this is a PCI to PCI bridge or not.
  */
-static VBOXSTRICTRC devpciR3UpdateMappings(PPDMDEVINS pDevIns, PPDMPCIDEV pPciDev, bool fP2PBridge)
+static VBOXSTRICTRC devpciR3UpdateMappings(PPDMPCIDEV pPciDev, bool fP2PBridge)
 {
     /* safe, only needs to go to the config space array */
@@ -2692,7 +2665,4 @@
             /*
              * Do real unmapping and/or mapping if the address change.
-             *
-             * For new style device we'll do the actual mapping, whereas old ones
-             * are expected to do it themselves via the callback.
              */
             Log4(("devpciR3UpdateMappings: dev %u/%u (%s): iRegion=%u addr=%#RX64 uNew=%#RX64\n",
@@ -2705,10 +2675,10 @@
                          pPciDev->pszNameR3, iRegion, pRegion->addr, uNew, cbRegion, cbRegion));
 
-                int rc = devpciR3UnmapRegion(pDevIns, pPciDev, iRegion);
+                int rc = devpciR3UnmapRegion(pPciDev, iRegion);
                 AssertLogRelRC(rc);
                 pRegion->addr = uNew;
                 if (uNew != INVALID_PCI_ADDRESS)
                 {
-                    /* The callout is optional with new style devices: */
+                    /* The callout is optional (typically not used): */
                     if (!pRegion->pfnMap)
                         rc = VINF_SUCCESS;
@@ -2720,5 +2690,5 @@
                     }
 
-                    /* We do the mapping for new-style devices: */
+                    /* We do the mapping for most devices: */
                     if (pRegion->hHandle != UINT64_MAX && rc != VINF_PCI_MAPPING_DONE)
                     {
@@ -3009,5 +2979,5 @@
              */
             if (fUpdateMappings)
-                rcStrict = devpciR3UpdateMappings(pDevIns, pPciDev, fP2PBridge);
+                rcStrict = devpciR3UpdateMappings(pPciDev, fP2PBridge);
         }
     }
@@ -3491,5 +3461,5 @@
                             == PCI_ADDRESS_SPACE_BAR64;
 
-        devpciR3UnmapRegion(pDevIns, pDev, iRegion);
+        devpciR3UnmapRegion(pDev, iRegion);
 
         if (f64Bit)
Index: /trunk/src/VBox/VMM/Makefile.kmk
===================================================================
--- /trunk/src/VBox/VMM/Makefile.kmk	(revision 82312)
+++ /trunk/src/VBox/VMM/Makefile.kmk	(revision 82313)
@@ -181,5 +181,4 @@
 	VMMAll/IEMAllAImplC.cpp \
 	VMMAll/IOMAll.cpp \
-	VMMAll/IOMAllMMIO.cpp \
 	VMMAll/IOMAllMmioNew.cpp \
 	VMMAll/MMAll.cpp \
@@ -512,5 +511,4 @@
 	VMMAll/IEMAllAImplC.cpp \
 	VMMAll/IOMAll.cpp \
-	VMMAll/IOMAllMMIO.cpp \
 	VMMAll/IOMAllMmioNew.cpp \
 	VMMAll/MMAll.cpp \
Index: /trunk/src/VBox/VMM/VMMAll/IOMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IOMAll.cpp	(revision 82312)
+++ /trunk/src/VBox/VMM/VMMAll/IOMAll.cpp	(revision 82313)
@@ -576,14 +576,2 @@
 }
 
-
-/**
- * Fress an MMIO range after the reference counter has become zero.
- *
- * @param   pVM                 The cross context VM structure.
- * @param   pRange              The range to free.
- */
-void iomMmioFreeRange(PVMCC pVM, PIOMMMIORANGE pRange)
-{
-    MMHyperFree(pVM, pRange);
-}
-
Index: unk/src/VBox/VMM/VMMAll/IOMAllMMIO.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IOMAllMMIO.cpp	(revision 82312)
+++ 	(revision )
@@ -1,1007 +1,0 @@
-/* $Id$ */
-/** @file
- * IOM - Input / Output Monitor - Any Context, MMIO & String I/O.
- */
-
-/*
- * Copyright (C) 2006-2019 Oracle Corporation
- *
- * This file is part of VirtualBox Open Source Edition (OSE), as
- * available from http://www.virtualbox.org. This file is free software;
- * you can redistribute it and/or modify it under the terms of the GNU
- * General Public License (GPL) as published by the Free Software
- * Foundation, in version 2 as it comes in the "COPYING" file of the
- * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
- * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
- */
-
-
-/*********************************************************************************************************************************
-*   Header Files                                                                                                                 *
-*********************************************************************************************************************************/
-#define LOG_GROUP LOG_GROUP_IOM_MMIO
-#include <VBox/vmm/iom.h>
-#include <VBox/vmm/cpum.h>
-#include <VBox/vmm/pgm.h>
-#include <VBox/vmm/selm.h>
-#include <VBox/vmm/mm.h>
-#include <VBox/vmm/em.h>
-#include <VBox/vmm/pgm.h>
-#include <VBox/vmm/trpm.h>
-#include <VBox/vmm/iem.h>
-#include "IOMInternal.h"
-#include <VBox/vmm/vmcc.h>
-#include <VBox/vmm/vmm.h>
-#include <VBox/vmm/hm.h>
-#include "IOMInline.h"
-
-#include <VBox/dis.h>
-#include <VBox/disopcode.h>
-#include <VBox/vmm/pdmdev.h>
-#include <VBox/param.h>
-#include <VBox/err.h>
-#include <iprt/assert.h>
-#include <VBox/log.h>
-#include <iprt/asm.h>
-#include <iprt/string.h>
-
-
-
-#ifndef IN_RING3
-/**
- * Defers a pending MMIO write to ring-3.
- *
- * @returns VINF_IOM_R3_MMIO_COMMIT_WRITE
- * @param   pVCpu       The cross context virtual CPU structure of the calling EMT.
- * @param   GCPhys      The write address.
- * @param   pvBuf       The bytes being written.
- * @param   cbBuf       How many bytes.
- * @param   pRange      The range, if resolved.
- */
-static VBOXSTRICTRC iomMmioRing3WritePending(PVMCPU pVCpu, RTGCPHYS GCPhys, void const *pvBuf, size_t cbBuf, PIOMMMIORANGE pRange)
-{
-    Log5(("iomMmioRing3WritePending: %RGp LB %#x\n", GCPhys, cbBuf));
-    if (pVCpu->iom.s.PendingMmioWrite.cbValue == 0)
-    {
-        pVCpu->iom.s.PendingMmioWrite.GCPhys  = GCPhys;
-        AssertReturn(cbBuf <= sizeof(pVCpu->iom.s.PendingMmioWrite.abValue), VERR_IOM_MMIO_IPE_2);
-        pVCpu->iom.s.PendingMmioWrite.cbValue = (uint32_t)cbBuf;
-        pVCpu->iom.s.PendingMmioWrite.idxMmioRegionHint = UINT32_MAX;
-        memcpy(pVCpu->iom.s.PendingMmioWrite.abValue, pvBuf, cbBuf);
-    }
-    else
-    {
-        /*
-         * Join with pending if adjecent.
-         *
-         * This may happen if the stack overflows into MMIO territory and RSP/ESP/SP
-         * isn't aligned. IEM will bounce buffer the access and do one write for each
-         * page.  We get here when the 2nd page part is written.
-         */
-        uint32_t const cbOldValue = pVCpu->iom.s.PendingMmioWrite.cbValue;
-        AssertMsgReturn(GCPhys == pVCpu->iom.s.PendingMmioWrite.GCPhys + cbOldValue,
-                        ("pending %RGp LB %#x; incoming %RGp LB %#x\n",
-                         pVCpu->iom.s.PendingMmioWrite.GCPhys, cbOldValue, GCPhys, cbBuf),
-                        VERR_IOM_MMIO_IPE_1);
-        AssertReturn(cbBuf <= sizeof(pVCpu->iom.s.PendingMmioWrite.abValue) - cbOldValue, VERR_IOM_MMIO_IPE_2);
-        pVCpu->iom.s.PendingMmioWrite.cbValue = cbOldValue + (uint32_t)cbBuf;
-        memcpy(&pVCpu->iom.s.PendingMmioWrite.abValue[cbOldValue], pvBuf, cbBuf);
-    }
-
-    VMCPU_FF_SET(pVCpu, VMCPU_FF_IOM);
-    RT_NOREF_PV(pRange);
-    return VINF_IOM_R3_MMIO_COMMIT_WRITE;
-}
-#endif
-
-
-/**
- * Deals with complicated MMIO writes.
- *
- * Complicated means unaligned or non-dword/qword sized accesses depending on
- * the MMIO region's access mode flags.
- *
- * @returns Strict VBox status code. Any EM scheduling status code,
- *          VINF_IOM_R3_MMIO_WRITE, VINF_IOM_R3_MMIO_READ_WRITE or
- *          VINF_IOM_R3_MMIO_READ may be returned.
- *
- * @param   pVM         The cross context VM structure.
- * @param   pVCpu       The cross context virtual CPU structure of the calling EMT.
- * @param   pRange      The range to write to.
- * @param   GCPhys      The physical address to start writing.
- * @param   pvValue     Where to store the value.
- * @param   cbValue     The size of the value to write.
- */
-static VBOXSTRICTRC iomMMIODoComplicatedWrite(PVM pVM, PVMCPU pVCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhys,
-                                              void const *pvValue, unsigned cbValue)
-{
-    RT_NOREF_PV(pVCpu);
-    AssertReturn(   (pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) != IOMMMIO_FLAGS_WRITE_PASSTHRU
-                 && (pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) <= IOMMMIO_FLAGS_WRITE_DWORD_QWORD_READ_MISSING,
-                 VERR_IOM_MMIO_IPE_1);
-    AssertReturn(cbValue != 0 && cbValue <= 16, VERR_IOM_MMIO_IPE_2);
-    RTGCPHYS const GCPhysStart  = GCPhys; NOREF(GCPhysStart);
-    bool const     fReadMissing = (pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_DWORD_READ_MISSING
-                               || (pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_DWORD_QWORD_READ_MISSING;
-
-    /*
-     * Do debug stop if requested.
-     */
-    int rc = VINF_SUCCESS; NOREF(pVM);
-#ifdef VBOX_STRICT
-    if (pRange->fFlags & IOMMMIO_FLAGS_DBGSTOP_ON_COMPLICATED_WRITE)
-    {
-# ifdef IN_RING3
-        LogRel(("IOM: Complicated write %#x byte at %RGp to %s, initiating debugger intervention\n", cbValue, GCPhys,
-                R3STRING(pRange->pszDesc)));
-        rc = DBGFR3EventSrc(pVM, DBGFEVENT_DEV_STOP, RT_SRC_POS,
-                            "Complicated write %#x byte at %RGp to %s\n", cbValue, GCPhys, R3STRING(pRange->pszDesc));
-        if (rc == VERR_DBGF_NOT_ATTACHED)
-            rc = VINF_SUCCESS;
-# else
-        return VINF_IOM_R3_MMIO_WRITE;
-# endif
-    }
-#endif
-
-    /*
-     * Check if we should ignore the write.
-     */
-    if ((pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_ONLY_DWORD)
-    {
-        Assert(cbValue != 4 || (GCPhys & 3));
-        return VINF_SUCCESS;
-    }
-    if ((pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_ONLY_DWORD_QWORD)
-    {
-        Assert((cbValue != 4 && cbValue != 8) || (GCPhys & (cbValue - 1)));
-        return VINF_SUCCESS;
-    }
-
-    /*
-     * Split and conquer.
-     */
-    for (;;)
-    {
-        unsigned const  offAccess  = GCPhys & 3;
-        unsigned        cbThisPart = 4 - offAccess;
-        if (cbThisPart > cbValue)
-            cbThisPart = cbValue;
-
-        /*
-         * Get the missing bits (if any).
-         */
-        uint32_t u32MissingValue = 0;
-        if (fReadMissing && cbThisPart != 4)
-        {
-            int rc2 = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser),
-                                                        GCPhys & ~(RTGCPHYS)3, &u32MissingValue, sizeof(u32MissingValue));
-            switch (rc2)
-            {
-                case VINF_SUCCESS:
-                    break;
-                case VINF_IOM_MMIO_UNUSED_FF:
-                    u32MissingValue = UINT32_C(0xffffffff);
-                    break;
-                case VINF_IOM_MMIO_UNUSED_00:
-                    u32MissingValue = 0;
-                    break;
-#ifndef IN_RING3
-                case VINF_IOM_R3_MMIO_READ:
-                case VINF_IOM_R3_MMIO_READ_WRITE:
-                case VINF_IOM_R3_MMIO_WRITE:
-                    LogFlow(("iomMMIODoComplicatedWrite: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc [read]\n", GCPhys, GCPhysStart, cbValue, rc2));
-                    rc2 = VBOXSTRICTRC_TODO(iomMmioRing3WritePending(pVCpu, GCPhys, pvValue, cbValue, pRange));
-                    if (rc == VINF_SUCCESS || rc2 < rc)
-                        rc = rc2;
-                    return rc;
-#endif
-                default:
-                    if (RT_FAILURE(rc2))
-                    {
-                        Log(("iomMMIODoComplicatedWrite: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc [read]\n", GCPhys, GCPhysStart, cbValue, rc2));
-                        return rc2;
-                    }
-                    AssertMsgReturn(rc2 >= VINF_EM_FIRST && rc2 <= VINF_EM_LAST, ("%Rrc\n", rc2), VERR_IPE_UNEXPECTED_INFO_STATUS);
-                    if (rc == VINF_SUCCESS || rc2 < rc)
-                        rc = rc2;
-                    break;
-            }
-        }
-
-        /*
-         * Merge missing and given bits.
-         */
-        uint32_t u32GivenMask;
-        uint32_t u32GivenValue;
-        switch (cbThisPart)
-        {
-            case 1:
-                u32GivenValue = *(uint8_t  const *)pvValue;
-                u32GivenMask  = UINT32_C(0x000000ff);
-                break;
-            case 2:
-                u32GivenValue = *(uint16_t const *)pvValue;
-                u32GivenMask  = UINT32_C(0x0000ffff);
-                break;
-            case 3:
-                u32GivenValue = RT_MAKE_U32_FROM_U8(((uint8_t const *)pvValue)[0], ((uint8_t const *)pvValue)[1],
-                                                    ((uint8_t const *)pvValue)[2], 0);
-                u32GivenMask  = UINT32_C(0x00ffffff);
-                break;
-            case 4:
-                u32GivenValue = *(uint32_t const *)pvValue;
-                u32GivenMask  = UINT32_C(0xffffffff);
-                break;
-            default:
-                AssertFailedReturn(VERR_IOM_MMIO_IPE_3);
-        }
-        if (offAccess)
-        {
-            u32GivenValue <<= offAccess * 8;
-            u32GivenMask  <<= offAccess * 8;
-        }
-
-        uint32_t u32Value = (u32MissingValue & ~u32GivenMask)
-                          | (u32GivenValue & u32GivenMask);
-
-        /*
-         * Do DWORD write to the device.
-         */
-        int rc2 = pRange->CTX_SUFF(pfnWriteCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser),
-                                                     GCPhys & ~(RTGCPHYS)3, &u32Value, sizeof(u32Value));
-        switch (rc2)
-        {
-            case VINF_SUCCESS:
-                break;
-#ifndef IN_RING3
-            case VINF_IOM_R3_MMIO_READ:
-            case VINF_IOM_R3_MMIO_READ_WRITE:
-            case VINF_IOM_R3_MMIO_WRITE:
-                Log3(("iomMMIODoComplicatedWrite: deferring GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc [write]\n", GCPhys, GCPhysStart, cbValue, rc2));
-                AssertReturn(pVCpu->iom.s.PendingMmioWrite.cbValue == 0, VERR_IOM_MMIO_IPE_1);
-                AssertReturn(cbValue + (GCPhys & 3) <= sizeof(pVCpu->iom.s.PendingMmioWrite.abValue), VERR_IOM_MMIO_IPE_2);
-                pVCpu->iom.s.PendingMmioWrite.GCPhys  = GCPhys & ~(RTGCPHYS)3;
-                pVCpu->iom.s.PendingMmioWrite.cbValue = cbValue + (GCPhys & 3);
-                *(uint32_t *)pVCpu->iom.s.PendingMmioWrite.abValue = u32Value;
-                if (cbValue > cbThisPart)
-                    memcpy(&pVCpu->iom.s.PendingMmioWrite.abValue[4],
-                           (uint8_t const *)pvValue + cbThisPart, cbValue - cbThisPart);
-                VMCPU_FF_SET(pVCpu, VMCPU_FF_IOM);
-                if (rc == VINF_SUCCESS)
-                    rc = VINF_IOM_R3_MMIO_COMMIT_WRITE;
-                return rc;
-#endif
-            default:
-                if (RT_FAILURE(rc2))
-                {
-                    Log(("iomMMIODoComplicatedWrite: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc [write]\n", GCPhys, GCPhysStart, cbValue, rc2));
-                    return rc2;
-                }
-                AssertMsgReturn(rc2 >= VINF_EM_FIRST && rc2 <= VINF_EM_LAST, ("%Rrc\n", rc2), VERR_IPE_UNEXPECTED_INFO_STATUS);
-                if (rc == VINF_SUCCESS || rc2 < rc)
-                    rc = rc2;
-                break;
-        }
-
-        /*
-         * Advance.
-         */
-        cbValue -= cbThisPart;
-        if (!cbValue)
-            break;
-        GCPhys += cbThisPart;
-        pvValue = (uint8_t const *)pvValue + cbThisPart;
-    }
-
-    return rc;
-}
-
-
-
-
-/**
- * Wrapper which does the write and updates range statistics when such are enabled.
- * @warning RT_SUCCESS(rc=VINF_IOM_R3_MMIO_WRITE) is TRUE!
- */
-static VBOXSTRICTRC iomMMIODoWrite(PVM pVM, PVMCPU pVCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault,
-                                   const void *pvData, unsigned cb)
-{
-#ifdef VBOX_WITH_STATISTICS
-    int rcSem = IOM_LOCK_SHARED(pVM);
-    if (rcSem == VERR_SEM_BUSY)
-        return VINF_IOM_R3_MMIO_WRITE;
-    PIOMMMIOSTATS pStats = iomMmioGetStats(pVM, pVCpu, GCPhysFault, pRange);
-    if (!pStats)
-# ifdef IN_RING3
-        return VERR_NO_MEMORY;
-# else
-        return VINF_IOM_R3_MMIO_WRITE;
-# endif
-    STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfWrite), a);
-#else
-    NOREF(pVCpu);
-#endif
-
-    VBOXSTRICTRC rcStrict;
-    if (RT_LIKELY(pRange->CTX_SUFF(pfnWriteCallback)))
-    {
-        if (   (cb == 4 && !(GCPhysFault & 3))
-            || (pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_PASSTHRU
-            || (cb == 8 && !(GCPhysFault & 7) && IOMMMIO_DOES_WRITE_MODE_ALLOW_QWORD(pRange->fFlags)) )
-            rcStrict = pRange->CTX_SUFF(pfnWriteCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser),
-                                                          GCPhysFault, (void *)pvData, cb); /** @todo fix const!! */
-        else
-            rcStrict = iomMMIODoComplicatedWrite(pVM, pVCpu, pRange, GCPhysFault, pvData, cb);
-    }
-    else
-        rcStrict = VINF_SUCCESS;
-
-    STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfWrite), a);
-    STAM_COUNTER_INC(&pStats->Accesses);
-    return rcStrict;
-}
-
-
-/**
- * Deals with complicated MMIO reads.
- *
- * Complicated means unaligned or non-dword/qword sized accesses depending on
- * the MMIO region's access mode flags.
- *
- * @returns Strict VBox status code. Any EM scheduling status code,
- *          VINF_IOM_R3_MMIO_READ, VINF_IOM_R3_MMIO_READ_WRITE or
- *          VINF_IOM_R3_MMIO_WRITE may be returned.
- *
- * @param   pVM                 The cross context VM structure.
- * @param   pRange              The range to read from.
- * @param   GCPhys              The physical address to start reading.
- * @param   pvValue             Where to store the value.
- * @param   cbValue             The size of the value to read.
- */
-static VBOXSTRICTRC iomMMIODoComplicatedRead(PVM pVM, PIOMMMIORANGE pRange, RTGCPHYS GCPhys, void *pvValue, unsigned cbValue)
-{
-    AssertReturn(   (pRange->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_DWORD
-                 || (pRange->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_DWORD_QWORD,
-                 VERR_IOM_MMIO_IPE_1);
-    AssertReturn(cbValue != 0 && cbValue <= 16, VERR_IOM_MMIO_IPE_2);
-    RTGCPHYS const GCPhysStart = GCPhys; NOREF(GCPhysStart);
-
-    /*
-     * Do debug stop if requested.
-     */
-    int rc = VINF_SUCCESS; NOREF(pVM);
-#ifdef VBOX_STRICT
-    if (pRange->fFlags & IOMMMIO_FLAGS_DBGSTOP_ON_COMPLICATED_READ)
-    {
-# ifdef IN_RING3
-        rc = DBGFR3EventSrc(pVM, DBGFEVENT_DEV_STOP, RT_SRC_POS,
-                            "Complicated read %#x byte at %RGp to %s\n", cbValue, GCPhys, R3STRING(pRange->pszDesc));
-        if (rc == VERR_DBGF_NOT_ATTACHED)
-            rc = VINF_SUCCESS;
-# else
-        return VINF_IOM_R3_MMIO_READ;
-# endif
-    }
-#endif
-
-    /*
-     * Split and conquer.
-     */
-    for (;;)
-    {
-        /*
-         * Do DWORD read from the device.
-         */
-        uint32_t u32Value;
-        int rc2 = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser),
-                                                    GCPhys & ~(RTGCPHYS)3, &u32Value, sizeof(u32Value));
-        switch (rc2)
-        {
-            case VINF_SUCCESS:
-                break;
-            case VINF_IOM_MMIO_UNUSED_FF:
-                u32Value = UINT32_C(0xffffffff);
-                break;
-            case VINF_IOM_MMIO_UNUSED_00:
-                u32Value = 0;
-                break;
-            case VINF_IOM_R3_MMIO_READ:
-            case VINF_IOM_R3_MMIO_READ_WRITE:
-            case VINF_IOM_R3_MMIO_WRITE:
-                /** @todo What if we've split a transfer and already read
-                 * something?  Since reads can have sideeffects we could be
-                 * kind of screwed here... */
-                LogFlow(("iomMMIODoComplicatedRead: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc\n", GCPhys, GCPhysStart, cbValue, rc2));
-                return rc2;
-            default:
-                if (RT_FAILURE(rc2))
-                {
-                    Log(("iomMMIODoComplicatedRead: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc\n", GCPhys, GCPhysStart, cbValue, rc2));
-                    return rc2;
-                }
-                AssertMsgReturn(rc2 >= VINF_EM_FIRST && rc2 <= VINF_EM_LAST, ("%Rrc\n", rc2), VERR_IPE_UNEXPECTED_INFO_STATUS);
-                if (rc == VINF_SUCCESS || rc2 < rc)
-                    rc = rc2;
-                break;
-        }
-        u32Value >>= (GCPhys & 3) * 8;
-
-        /*
-         * Write what we've read.
-         */
-        unsigned cbThisPart = 4 - (GCPhys & 3);
-        if (cbThisPart > cbValue)
-            cbThisPart = cbValue;
-
-        switch (cbThisPart)
-        {
-            case 1:
-                *(uint8_t *)pvValue = (uint8_t)u32Value;
-                break;
-            case 2:
-                *(uint16_t *)pvValue = (uint16_t)u32Value;
-                break;
-            case 3:
-                ((uint8_t *)pvValue)[0] = RT_BYTE1(u32Value);
-                ((uint8_t *)pvValue)[1] = RT_BYTE2(u32Value);
-                ((uint8_t *)pvValue)[2] = RT_BYTE3(u32Value);
-                break;
-            case 4:
-                *(uint32_t *)pvValue = u32Value;
-                break;
-        }
-
-        /*
-         * Advance.
-         */
-        cbValue -= cbThisPart;
-        if (!cbValue)
-            break;
-        GCPhys += cbThisPart;
-        pvValue = (uint8_t *)pvValue + cbThisPart;
-    }
-
-    return rc;
-}
-
-
-/**
- * Implements VINF_IOM_MMIO_UNUSED_FF.
- *
- * @returns VINF_SUCCESS.
- * @param   pvValue             Where to store the zeros.
- * @param   cbValue             How many bytes to read.
- */
-static int iomMMIODoReadFFs(void *pvValue, size_t cbValue)
-{
-    switch (cbValue)
-    {
-        case 1: *(uint8_t  *)pvValue = UINT8_C(0xff); break;
-        case 2: *(uint16_t *)pvValue = UINT16_C(0xffff); break;
-        case 4: *(uint32_t *)pvValue = UINT32_C(0xffffffff); break;
-        case 8: *(uint64_t *)pvValue = UINT64_C(0xffffffffffffffff); break;
-        default:
-        {
-            uint8_t *pb = (uint8_t *)pvValue;
-            while (cbValue--)
-                *pb++ = UINT8_C(0xff);
-            break;
-        }
-    }
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Implements VINF_IOM_MMIO_UNUSED_00.
- *
- * @returns VINF_SUCCESS.
- * @param   pvValue             Where to store the zeros.
- * @param   cbValue             How many bytes to read.
- */
-static int iomMMIODoRead00s(void *pvValue, size_t cbValue)
-{
-    switch (cbValue)
-    {
-        case 1: *(uint8_t  *)pvValue = UINT8_C(0x00); break;
-        case 2: *(uint16_t *)pvValue = UINT16_C(0x0000); break;
-        case 4: *(uint32_t *)pvValue = UINT32_C(0x00000000); break;
-        case 8: *(uint64_t *)pvValue = UINT64_C(0x0000000000000000); break;
-        default:
-        {
-            uint8_t *pb = (uint8_t *)pvValue;
-            while (cbValue--)
-                *pb++ = UINT8_C(0x00);
-            break;
-        }
-    }
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Wrapper which does the read and updates range statistics when such are enabled.
- */
-DECLINLINE(VBOXSTRICTRC) iomMMIODoRead(PVM pVM, PVMCPU pVCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhys,
-                                       void *pvValue, unsigned cbValue)
-{
-#ifdef VBOX_WITH_STATISTICS
-    int rcSem = IOM_LOCK_SHARED(pVM);
-    if (rcSem == VERR_SEM_BUSY)
-        return VINF_IOM_R3_MMIO_READ;
-    PIOMMMIOSTATS pStats = iomMmioGetStats(pVM, pVCpu, GCPhys, pRange);
-    if (!pStats)
-# ifdef IN_RING3
-        return VERR_NO_MEMORY;
-# else
-        return VINF_IOM_R3_MMIO_READ;
-# endif
-    STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfRead), a);
-#else
-    NOREF(pVCpu);
-#endif
-
-    VBOXSTRICTRC rcStrict;
-    if (RT_LIKELY(pRange->CTX_SUFF(pfnReadCallback)))
-    {
-        if (   (   cbValue == 4
-                && !(GCPhys & 3))
-            || (pRange->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_PASSTHRU
-            || (    cbValue == 8
-                && !(GCPhys & 7)
-                && (pRange->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_DWORD_QWORD ) )
-            rcStrict = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhys,
-                                                         pvValue, cbValue);
-        else
-            rcStrict = iomMMIODoComplicatedRead(pVM, pRange, GCPhys, pvValue, cbValue);
-    }
-    else
-        rcStrict = VINF_IOM_MMIO_UNUSED_FF;
-    if (rcStrict != VINF_SUCCESS)
-    {
-        switch (VBOXSTRICTRC_VAL(rcStrict))
-        {
-            case VINF_IOM_MMIO_UNUSED_FF: rcStrict = iomMMIODoReadFFs(pvValue, cbValue); break;
-            case VINF_IOM_MMIO_UNUSED_00: rcStrict = iomMMIODoRead00s(pvValue, cbValue); break;
-        }
-    }
-
-    STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfRead), a);
-    STAM_COUNTER_INC(&pStats->Accesses);
-    return rcStrict;
-}
-
-/**
- * Common worker for the \#PF handler and IOMMMIOPhysHandler (APIC+VT-x).
- *
- * @returns VBox status code (appropriate for GC return).
- * @param   pVM         The cross context VM structure.
- * @param   pVCpu       The cross context virtual CPU structure of the calling EMT.
- * @param   uErrorCode  CPU Error code.  This is UINT32_MAX when we don't have
- *                      any error code (the EPT misconfig hack).
- * @param   pCtxCore    Trap register frame.
- * @param   GCPhysFault The GC physical address corresponding to pvFault.
- * @param   pvUser      Pointer to the MMIO ring-3 range entry.
- */
-VBOXSTRICTRC iomMmioCommonPfHandlerOld(PVMCC pVM, PVMCPUCC pVCpu, uint32_t uErrorCode, PCPUMCTXCORE pCtxCore,
-                                       RTGCPHYS GCPhysFault, void *pvUser)
-{
-    RT_NOREF_PV(uErrorCode);
-    int rc = IOM_LOCK_SHARED(pVM);
-#ifndef IN_RING3
-    if (rc == VERR_SEM_BUSY)
-        return VINF_IOM_R3_MMIO_READ_WRITE;
-#endif
-    AssertRC(rc);
-
-    STAM_PROFILE_START(&pVM->iom.s.StatRZMMIOHandler, a);
-    Log(("iomMmioCommonPfHandlerOld: GCPhys=%RGp uErr=%#x rip=%RGv\n", GCPhysFault, uErrorCode, (RTGCPTR)pCtxCore->rip));
-
-    PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
-    Assert(pRange);
-    Assert(pRange == iomMmioGetRange(pVM, pVCpu, GCPhysFault));
-    iomMmioRetainRange(pRange);
-#ifndef VBOX_WITH_STATISTICS
-    IOM_UNLOCK_SHARED(pVM);
-
-#else
-    /*
-     * Locate the statistics.
-     */
-    PIOMMMIOSTATS pStats = iomMmioGetStats(pVM, pVCpu, GCPhysFault, pRange);
-    if (!pStats)
-    {
-        iomMmioReleaseRange(pVM, pRange);
-# ifdef IN_RING3
-        return VERR_NO_MEMORY;
-# else
-        STAM_PROFILE_STOP(&pVM->iom.s.StatRZMMIOHandler, a);
-        return VINF_IOM_R3_MMIO_READ_WRITE;
-# endif
-    }
-#endif
-
-#ifndef IN_RING3
-    /*
-     * Should we defer the request right away?  This isn't usually the case, so
-     * do the simple test first and the try deal with uErrorCode being N/A.
-     */
-    if (RT_UNLIKELY(   (   !pRange->CTX_SUFF(pfnWriteCallback)
-                        || !pRange->CTX_SUFF(pfnReadCallback))
-                    && (  uErrorCode == UINT32_MAX
-                        ? pRange->pfnWriteCallbackR3 || pRange->pfnReadCallbackR3
-                        : uErrorCode & X86_TRAP_PF_RW
-                          ? !pRange->CTX_SUFF(pfnWriteCallback) && pRange->pfnWriteCallbackR3
-                          : !pRange->CTX_SUFF(pfnReadCallback)  && pRange->pfnReadCallbackR3
-                        )
-                   )
-       )
-    {
-        if (uErrorCode & X86_TRAP_PF_RW)
-            STAM_COUNTER_INC(&pStats->CTX_MID_Z(Write,ToR3));
-        else
-            STAM_COUNTER_INC(&pStats->CTX_MID_Z(Read,ToR3));
-
-        STAM_PROFILE_STOP(&pVM->iom.s.StatRZMMIOHandler, a);
-        iomMmioReleaseRange(pVM, pRange);
-        return VINF_IOM_R3_MMIO_READ_WRITE;
-    }
-#endif /* !IN_RING3 */
-
-    /*
-     * Retain the range and do locking.
-     */
-    PPDMDEVINS pDevIns = pRange->CTX_SUFF(pDevIns);
-    rc = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_MMIO_READ_WRITE);
-    if (rc != VINF_SUCCESS)
-    {
-        iomMmioReleaseRange(pVM, pRange);
-        return rc;
-    }
-
-    /*
-     * Let IEM call us back via iomMmioHandler.
-     */
-    VBOXSTRICTRC rcStrict = IEMExecOne(pVCpu);
-
-    NOREF(pCtxCore); NOREF(GCPhysFault);
-    STAM_PROFILE_STOP(&pVM->iom.s.StatRZMMIOHandler, a);
-    PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
-    iomMmioReleaseRange(pVM, pRange);
-    if (RT_SUCCESS(rcStrict))
-        return rcStrict;
-    if (   rcStrict == VERR_IEM_ASPECT_NOT_IMPLEMENTED
-        || rcStrict == VERR_IEM_INSTR_NOT_IMPLEMENTED)
-    {
-        Log(("IOM: Hit unsupported IEM feature!\n"));
-        rcStrict = VINF_EM_RAW_EMULATE_INSTR;
-    }
-    return rcStrict;
-}
-
-
-/**
- * @callback_method_impl{FNPGMRZPHYSPFHANDLER,
- *      \#PF access handler callback for MMIO pages.}
- *
- * @remarks The @a pvUser argument points to the IOMMMIORANGE.
- */
-DECLEXPORT(VBOXSTRICTRC) iomMmioPfHandler(PVMCC pVM, PVMCPUCC pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore, RTGCPTR pvFault,
-                                          RTGCPHYS GCPhysFault, void *pvUser)
-{
-    LogFlow(("iomMmioPfHandler: GCPhys=%RGp uErr=%#x pvFault=%RGv rip=%RGv\n",
-             GCPhysFault, (uint32_t)uErrorCode, pvFault, (RTGCPTR)pCtxCore->rip)); NOREF(pvFault);
-    return iomMmioCommonPfHandlerOld(pVM, pVCpu, (uint32_t)uErrorCode, pCtxCore, GCPhysFault, pvUser);
-}
-
-
-/**
- * @callback_method_impl{FNPGMPHYSHANDLER, MMIO page accesses}
- *
- * @remarks The @a pvUser argument points to the MMIO range entry.
- */
-PGM_ALL_CB2_DECL(VBOXSTRICTRC) iomMmioHandler(PVMCC pVM, PVMCPUCC pVCpu, RTGCPHYS GCPhysFault, void *pvPhys, void *pvBuf,
-                                              size_t cbBuf, PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
-{
-    PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
-    STAM_COUNTER_INC(&pVM->iom.s.StatR3MMIOHandler);
-
-    NOREF(pvPhys); NOREF(enmOrigin);
-    AssertPtr(pRange);
-    AssertMsg(cbBuf >= 1, ("%zu\n", cbBuf));
-
-
-#ifndef IN_RING3
-    /*
-     * If someone is doing FXSAVE, FXRSTOR, XSAVE, XRSTOR or other stuff dealing with
-     * large amounts of data, just go to ring-3 where we don't need to deal with partial
-     * successes.  No chance any of these will be problematic read-modify-write stuff.
-     */
-    if (cbBuf > sizeof(pVCpu->iom.s.PendingMmioWrite.abValue))
-        return enmAccessType == PGMACCESSTYPE_WRITE ? VINF_IOM_R3_MMIO_WRITE : VINF_IOM_R3_MMIO_READ;
-#endif
-
-    /*
-     * Validate the range.
-     */
-    int rc = IOM_LOCK_SHARED(pVM);
-#ifndef IN_RING3
-    if (rc == VERR_SEM_BUSY)
-    {
-        if (enmAccessType == PGMACCESSTYPE_READ)
-            return VINF_IOM_R3_MMIO_READ;
-        Assert(enmAccessType == PGMACCESSTYPE_WRITE);
-        return iomMmioRing3WritePending(pVCpu, GCPhysFault, pvBuf, cbBuf, NULL /*pRange*/);
-    }
-#endif
-    AssertRC(rc);
-    Assert(pRange == iomMmioGetRange(pVM, pVCpu, GCPhysFault));
-
-    /*
-     * Perform locking.
-     */
-    iomMmioRetainRange(pRange);
-    PPDMDEVINS pDevIns = pRange->CTX_SUFF(pDevIns);
-    IOM_UNLOCK_SHARED(pVM);
-#ifdef IN_RING3
-    VBOXSTRICTRC rcStrict = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_MMIO_READ_WRITE);
-#else
-    VBOXSTRICTRC rcStrict = pDevIns ? PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_MMIO_READ_WRITE)
-                          : VINF_IOM_R3_MMIO_READ_WRITE;
-#endif
-    if (rcStrict == VINF_SUCCESS)
-    {
-        /*
-         * Perform the access.
-         */
-        if (enmAccessType == PGMACCESSTYPE_READ)
-            rcStrict = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, pvBuf, (unsigned)cbBuf);
-        else
-        {
-            rcStrict = iomMMIODoWrite(pVM, pVCpu, pRange, GCPhysFault, pvBuf, (unsigned)cbBuf);
-#ifndef IN_RING3
-            if (rcStrict == VINF_IOM_R3_MMIO_WRITE)
-                rcStrict = iomMmioRing3WritePending(pVCpu, GCPhysFault, pvBuf, cbBuf, pRange);
-#endif
-        }
-
-        /* Check the return code. */
-#ifdef IN_RING3
-        AssertMsg(rcStrict == VINF_SUCCESS, ("%Rrc -  Access type %d - %RGp - %s\n",
-                                             VBOXSTRICTRC_VAL(rcStrict), enmAccessType, GCPhysFault, pRange->pszDesc));
-#else
-        AssertMsg(   rcStrict == VINF_SUCCESS
-                  || rcStrict == (enmAccessType == PGMACCESSTYPE_READ ? VINF_IOM_R3_MMIO_READ :  VINF_IOM_R3_MMIO_WRITE)
-                  || (rcStrict == VINF_IOM_R3_MMIO_COMMIT_WRITE && enmAccessType == PGMACCESSTYPE_WRITE)
-                  || rcStrict == VINF_IOM_R3_MMIO_READ_WRITE
-                  || rcStrict == VINF_EM_DBG_STOP
-                  || rcStrict == VINF_EM_DBG_EVENT
-                  || rcStrict == VINF_EM_DBG_BREAKPOINT
-                  || rcStrict == VINF_EM_OFF
-                  || rcStrict == VINF_EM_SUSPEND
-                  || rcStrict == VINF_EM_RESET
-                  //|| rcStrict == VINF_EM_HALT       /* ?? */
-                  //|| rcStrict == VINF_EM_NO_MEMORY  /* ?? */
-                  , ("%Rrc - Access type %d - %RGp - %p\n", VBOXSTRICTRC_VAL(rcStrict), enmAccessType, GCPhysFault, pDevIns));
-#endif
-
-        iomMmioReleaseRange(pVM, pRange);
-        PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
-    }
-#ifdef IN_RING3
-    else
-        iomMmioReleaseRange(pVM, pRange);
-#else
-    else
-    {
-        if (rcStrict == VINF_IOM_R3_MMIO_READ_WRITE)
-        {
-            if (enmAccessType == PGMACCESSTYPE_READ)
-                rcStrict = VINF_IOM_R3_MMIO_READ;
-            else
-            {
-                Assert(enmAccessType == PGMACCESSTYPE_WRITE);
-                rcStrict = iomMmioRing3WritePending(pVCpu, GCPhysFault, pvBuf, cbBuf, pRange);
-            }
-        }
-        iomMmioReleaseRange(pVM, pRange);
-    }
-#endif
-    return rcStrict;
-}
-
-
-#if 0  /* not used any more */
-/**
- * Mapping an MMIO2 page in place of an MMIO page for direct access.
- *
- * (This is a special optimization used by the VGA device.)
- *
- * @returns VBox status code.  This API may return VINF_SUCCESS even if no
- *          remapping is made,.
- *
- * @param   pVM             The cross context VM structure.
- * @param   GCPhys          The address of the MMIO page to be changed.
- * @param   GCPhysRemapped  The address of the MMIO2 page.
- * @param   fPageFlags      Page flags to set. Must be (X86_PTE_RW | X86_PTE_P)
- *                          for the time being.
- */
-VMMDECL(int) IOMMMIOMapMMIO2Page(PVMCC pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysRemapped, uint64_t fPageFlags)
-{
-    /* Currently only called from the VGA device during MMIO. */
-    Log(("IOMMMIOMapMMIO2Page %RGp -> %RGp flags=%RX64\n", GCPhys, GCPhysRemapped, fPageFlags));
-    AssertReturn(fPageFlags == (X86_PTE_RW | X86_PTE_P), VERR_INVALID_PARAMETER);
-    PVMCPUCC pVCpu = VMMGetCpu(pVM);
-
-    /* This currently only works in real mode, protected mode without paging or with nested paging. */
-    /** @todo NEM: MMIO page aliasing. */
-    if (    !HMIsEnabled(pVM)       /* useless without VT-x/AMD-V */
-        ||  (   CPUMIsGuestInPagedProtectedMode(pVCpu)
-             && !HMIsNestedPagingActive(pVM)))
-        return VINF_SUCCESS;    /* ignore */
-
-    int rc = IOM_LOCK_SHARED(pVM);
-    if (RT_FAILURE(rc))
-        return VINF_SUCCESS; /* better luck the next time around */
-
-    /*
-     * Lookup the context range node the page belongs to.
-     */
-    PIOMMMIORANGE pRange = iomMmioGetRange(pVM, pVCpu, GCPhys);
-    AssertMsgReturn(pRange,
-                    ("Handlers and page tables are out of sync or something! GCPhys=%RGp\n", GCPhys), VERR_IOM_MMIO_RANGE_NOT_FOUND);
-
-    Assert((pRange->GCPhys       & PAGE_OFFSET_MASK) == 0);
-    Assert((pRange->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
-
-    /*
-     * Do the aliasing; page align the addresses since PGM is picky.
-     */
-    GCPhys         &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
-    GCPhysRemapped &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
-
-    rc = PGMHandlerPhysicalPageAlias(pVM, pRange->GCPhys, GCPhys, GCPhysRemapped);
-
-    IOM_UNLOCK_SHARED(pVM);
-    AssertRCReturn(rc, rc);
-
-    /*
-     * Modify the shadow page table. Since it's an MMIO page it won't be present and we
-     * can simply prefetch it.
-     *
-     * Note: This is a NOP in the EPT case; we'll just let it fault again to resync the page.
-     */
-# if 0 /* The assertion is wrong for the PGM_SYNC_CLEAR_PGM_POOL and VINF_PGM_HANDLER_ALREADY_ALIASED cases. */
-#  ifdef VBOX_STRICT
-    uint64_t fFlags;
-    RTHCPHYS HCPhys;
-    rc = PGMShwGetPage(pVCpu, (RTGCPTR)GCPhys, &fFlags, &HCPhys);
-    Assert(rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
-#  endif
-# endif
-    rc = PGMPrefetchPage(pVCpu, (RTGCPTR)GCPhys);
-    Assert(rc == VINF_SUCCESS || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
-    return VINF_SUCCESS;
-}
-#endif /* unused */
-
-#if 0  /* not used any more */
-/**
- * Mapping a HC page in place of an MMIO page for direct access.
- *
- * (This is a special optimization used by the APIC in the VT-x case.)
- *
- * @returns VBox status code.
- *
- * @param   pVM             The cross context VM structure.
- * @param   pVCpu           The cross context virtual CPU structure.
- * @param   GCPhys          The address of the MMIO page to be changed.
- * @param   HCPhys          The address of the host physical page.
- * @param   fPageFlags      Page flags to set. Must be (X86_PTE_RW | X86_PTE_P)
- *                          for the time being.
- */
-VMMDECL(int) IOMMMIOMapMMIOHCPage(PVMCC pVM, PVMCPUCC pVCpu, RTGCPHYS GCPhys, RTHCPHYS HCPhys, uint64_t fPageFlags)
-{
-    /* Currently only called from VT-x code during a page fault. */
-    Log(("IOMMMIOMapMMIOHCPage %RGp -> %RGp flags=%RX64\n", GCPhys, HCPhys, fPageFlags));
-
-    AssertReturn(fPageFlags == (X86_PTE_RW | X86_PTE_P), VERR_INVALID_PARAMETER);
-    /** @todo NEM: MMIO page aliasing. */
-    Assert(HMIsEnabled(pVM));
-
-    /*
-     * Lookup the context range node the page belongs to.
-     */
-# ifdef VBOX_STRICT
-    /* Can't lock IOM here due to potential deadlocks in the VGA device; not safe to access. */
-    PIOMMMIORANGE pRange = iomMMIOGetRangeUnsafe(pVM, pVCpu, GCPhys);
-    AssertMsgReturn(pRange,
-            ("Handlers and page tables are out of sync or something! GCPhys=%RGp\n", GCPhys), VERR_IOM_MMIO_RANGE_NOT_FOUND);
-    Assert((pRange->GCPhys       & PAGE_OFFSET_MASK) == 0);
-    Assert((pRange->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
-# endif
-
-    /*
-     * Do the aliasing; page align the addresses since PGM is picky.
-     */
-    GCPhys &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
-    HCPhys &= ~(RTHCPHYS)PAGE_OFFSET_MASK;
-
-    int rc = PGMHandlerPhysicalPageAliasHC(pVM, GCPhys, GCPhys, HCPhys);
-    AssertRCReturn(rc, rc);
-
-    /*
-     * Modify the shadow page table. Since it's an MMIO page it won't be present and we
-     * can simply prefetch it.
-     *
-     * Note: This is a NOP in the EPT case; we'll just let it fault again to resync the page.
-     */
-    rc = PGMPrefetchPage(pVCpu, (RTGCPTR)GCPhys);
-    Assert(rc == VINF_SUCCESS || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
-    return VINF_SUCCESS;
-}
-#endif
-
-#if 0 /* unused */
-/**
- * Reset a previously modified MMIO region; restore the access flags.
- *
- * @returns VBox status code.
- *
- * @param   pVM             The cross context VM structure.
- * @param   GCPhys          Physical address that's part of the MMIO region to be reset.
- */
-VMMDECL(int) IOMMMIOResetRegion(PVMCC pVM, RTGCPHYS GCPhys)
-{
-    Log(("IOMMMIOResetRegion %RGp\n", GCPhys));
-
-    PVMCPUCC pVCpu = VMMGetCpu(pVM);
-
-    /* This currently only works in real mode, protected mode without paging or with nested paging. */
-    /** @todo NEM: MMIO page aliasing. */
-    if (    !HMIsEnabled(pVM)       /* useless without VT-x/AMD-V */
-        ||  (   CPUMIsGuestInPagedProtectedMode(pVCpu)
-             && !HMIsNestedPagingActive(pVM)))
-        return VINF_SUCCESS;    /* ignore */
-
-    /*
-     * Lookup the context range node the page belongs to.
-     */
-# ifdef VBOX_STRICT
-    /* Can't lock IOM here due to potential deadlocks in the VGA device; not safe to access. */
-    PIOMMMIORANGE pRange = iomMMIOGetRangeUnsafe(pVM, pVCpu, GCPhys);
-    AssertMsgReturn(pRange,
-            ("Handlers and page tables are out of sync or something! GCPhys=%RGp\n", GCPhys), VERR_IOM_MMIO_RANGE_NOT_FOUND);
-    Assert((pRange->GCPhys       & PAGE_OFFSET_MASK) == 0);
-    Assert((pRange->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
-# endif
-
-    /*
-     * Call PGM to do the job work.
-     *
-     * After the call, all the pages should be non-present... unless there is
-     * a page pool flush pending (unlikely).
-     */
-    int rc = PGMHandlerPhysicalReset(pVM, GCPhys);
-    AssertRC(rc);
-
-# ifdef VBOX_STRICT
-    if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3))
-    {
-        uint32_t cb = pRange->cb;
-        GCPhys = pRange->GCPhys;
-        while (cb)
-        {
-            uint64_t fFlags;
-            RTHCPHYS HCPhys;
-            rc = PGMShwGetPage(pVCpu, (RTGCPTR)GCPhys, &fFlags, &HCPhys);
-            Assert(rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
-            cb     -= PAGE_SIZE;
-            GCPhys += PAGE_SIZE;
-        }
-    }
-# endif
-    return rc;
-}
-#endif /*unused */
Index: /trunk/src/VBox/VMM/VMMAll/IOMAllMmioNew.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IOMAllMmioNew.cpp	(revision 82312)
+++ /trunk/src/VBox/VMM/VMMAll/IOMAllMmioNew.cpp	(revision 82313)
@@ -779,31 +779,9 @@
         RTGCPHYS offRegion;
         CTX_SUFF(PIOMMMIOENTRY) pRegEntry = iomMmioGetEntry(pVM, GCPhysFault, &offRegion, &pVCpu->iom.s.idxMmioLastPhysHandler);
+        IOM_UNLOCK_SHARED(pVM);
         if (RT_LIKELY(pRegEntry))
-        {
-            IOM_UNLOCK_SHARED(pVM);
             rcStrict = iomMmioCommonPfHandlerNew(pVM, pVCpu, (uint32_t)uErrorCode, GCPhysFault, pRegEntry);
-        }
         else
-        {
-            /*
-             * Old style registrations.
-             */
-            PIOMMMIORANGE pRange = iomMmioGetRange(pVM, pVCpu, GCPhysFault);
-            if (pRange)
-            {
-                iomMmioRetainRange(pRange);
-                IOM_UNLOCK_SHARED(pVM);
-
-                rcStrict = iomMmioCommonPfHandlerOld(pVM, pVCpu, (uint32_t)uErrorCode,
-                                                     CPUMCTX2CORE(&pVCpu->cpum.GstCtx), GCPhysFault, pRange);
-
-                iomMmioReleaseRange(pVM, pRange);
-            }
-            else
-            {
-                IOM_UNLOCK_SHARED(pVM);
-                rcStrict = VERR_IOM_MMIO_RANGE_NOT_FOUND;
-            }
-        }
+            rcStrict = VERR_IOM_MMIO_RANGE_NOT_FOUND;
     }
     else if (rcStrict == VERR_SEM_BUSY)
Index: /trunk/src/VBox/VMM/VMMR3/IOM.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/IOM.cpp	(revision 82312)
+++ /trunk/src/VBox/VMM/VMMR3/IOM.cpp	(revision 82313)
@@ -127,11 +127,4 @@
 #include <VBox/err.h>
 
-#include "IOMInline.h"
-
-
-/*********************************************************************************************************************************
-*   Internal Functions                                                                                                           *
-*********************************************************************************************************************************/
-static void iomR3FlushCache(PVM pVM);
 
 
@@ -164,20 +157,6 @@
 
     /*
-     * Allocate the trees structure.
-     */
-    rc = MMHyperAlloc(pVM, sizeof(*pVM->iom.s.pTreesR3), 0, MM_TAG_IOM, (void **)&pVM->iom.s.pTreesR3);
-    AssertRCReturn(rc, rc);
-    pVM->iom.s.pTreesR0 = MMHyperR3ToR0(pVM, pVM->iom.s.pTreesR3);
-
-    /*
      * Register the MMIO access handler type.
      */
-    rc = PGMR3HandlerPhysicalTypeRegister(pVM, PGMPHYSHANDLERKIND_MMIO,
-                                          iomMmioHandler,
-                                          NULL, "iomMmioHandler", "iomMmioPfHandler",
-                                          NULL, "iomMmioHandler", "iomMmioPfHandler",
-                                          "MMIO", &pVM->iom.s.hMmioHandlerType);
-    AssertRCReturn(rc, rc);
-
     rc = PGMR3HandlerPhysicalTypeRegister(pVM, PGMPHYSHANDLERKIND_MMIO,
                                           iomMmioHandlerNew,
@@ -215,7 +194,4 @@
     STAM_REG(pVM, &pVM->iom.s.StatMmioCommitsDirect,  STAMTYPE_COUNTER, "/IOM/MmioCommitsDirect",                   STAMUNIT_OCCURENCES,     "Number of ring-3 MMIO commits direct to handler via handle hint.");
     STAM_REG(pVM, &pVM->iom.s.StatMmioCommitsPgm,     STAMTYPE_COUNTER, "/IOM/MmioCommitsPgm",                      STAMUNIT_OCCURENCES,     "Number of ring-3 MMIO commits via PGM.");
-
-    /* Redundant, but just in case we change something in the future */
-    iomR3FlushCache(pVM);
 
     LogFlow(("IOMR3Init: returns VINF_SUCCESS\n"));
@@ -272,41 +248,11 @@
 
 /**
- * Flushes the IOM port & statistics lookup cache
+ * The VM is being reset.
  *
  * @param   pVM     The cross context VM structure.
  */
-static void iomR3FlushCache(PVM pVM)
-{
-    /*
-     * Since all relevant (1) cache use requires at least read access to the
-     * critical section, we can exclude all other EMTs by grabbing exclusive
-     * access to the critical section and then safely update the caches of
-     * other EMTs.
-     * (1) The irrelvant access not holding the lock is in assertion code.
-     */
-    IOM_LOCK_EXCL(pVM);
-    VMCPUID idCpu = pVM->cCpus;
-    while (idCpu-- > 0)
-    {
-        PVMCPU pVCpu = pVM->apCpusR3[idCpu];
-        pVCpu->iom.s.pMMIORangeLastR0  = NIL_RTR0PTR;
-        pVCpu->iom.s.pMMIOStatsLastR0  = NIL_RTR0PTR;
-
-        pVCpu->iom.s.pMMIORangeLastR3  = NULL;
-        pVCpu->iom.s.pMMIOStatsLastR3  = NULL;
-    }
-
-    IOM_UNLOCK_EXCL(pVM);
-}
-
-
-/**
- * The VM is being reset.
- *
- * @param   pVM     The cross context VM structure.
- */
 VMMR3_INT_DECL(void) IOMR3Reset(PVM pVM)
 {
-    iomR3FlushCache(pVM);
+    RT_NOREF(pVM);
 }
 
@@ -344,460 +290,4 @@
     NOREF(pVM);
     return VINF_SUCCESS;
-}
-
-
-#ifdef VBOX_WITH_STATISTICS
-
-/**
- * Create the statistics node for an MMIO address.
- *
- * @returns Pointer to new stats node.
- *
- * @param   pVM         The cross context VM structure.
- * @param   GCPhys      The address.
- * @param   pszDesc     Description.
- */
-PIOMMMIOSTATS iomR3MMIOStatsCreate(PVM pVM, RTGCPHYS GCPhys, const char *pszDesc)
-{
-    IOM_LOCK_EXCL(pVM);
-
-    /* check if it already exists. */
-    PIOMMMIOSTATS pStats = (PIOMMMIOSTATS)RTAvloGCPhysGet(&pVM->iom.s.pTreesR3->MmioStatTree, GCPhys);
-    if (pStats)
-    {
-        IOM_UNLOCK_EXCL(pVM);
-        return pStats;
-    }
-
-    /* allocate stats node. */
-    int rc = MMHyperAlloc(pVM, sizeof(*pStats), 0, MM_TAG_IOM_STATS, (void **)&pStats);
-    AssertRC(rc);
-    if (RT_SUCCESS(rc))
-    {
-        /* insert into the tree. */
-        pStats->Core.Key = GCPhys;
-        if (RTAvloGCPhysInsert(&pVM->iom.s.pTreesR3->MmioStatTree, &pStats->Core))
-        {
-            IOM_UNLOCK_EXCL(pVM);
-
-            rc = STAMR3RegisterF(pVM, &pStats->Accesses,    STAMTYPE_COUNTER, STAMVISIBILITY_USED, STAMUNIT_OCCURENCES,     pszDesc, "/IOM/MMIO/%RGp",              GCPhys); AssertRC(rc);
-            rc = STAMR3RegisterF(pVM, &pStats->ProfReadR3,  STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL, pszDesc, "/IOM/MMIO/%RGp/Read-R3",      GCPhys); AssertRC(rc);
-            rc = STAMR3RegisterF(pVM, &pStats->ProfWriteR3, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL, pszDesc, "/IOM/MMIO/%RGp/Write-R3",     GCPhys); AssertRC(rc);
-            rc = STAMR3RegisterF(pVM, &pStats->ProfReadRZ,  STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL, pszDesc, "/IOM/MMIO/%RGp/Read-RZ",      GCPhys); AssertRC(rc);
-            rc = STAMR3RegisterF(pVM, &pStats->ProfWriteRZ, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL, pszDesc, "/IOM/MMIO/%RGp/Write-RZ",     GCPhys); AssertRC(rc);
-            rc = STAMR3RegisterF(pVM, &pStats->ReadRZToR3,  STAMTYPE_COUNTER, STAMVISIBILITY_USED, STAMUNIT_OCCURENCES,     pszDesc, "/IOM/MMIO/%RGp/Read-RZtoR3",  GCPhys); AssertRC(rc);
-            rc = STAMR3RegisterF(pVM, &pStats->WriteRZToR3, STAMTYPE_COUNTER, STAMVISIBILITY_USED, STAMUNIT_OCCURENCES,     pszDesc, "/IOM/MMIO/%RGp/Write-RZtoR3", GCPhys); AssertRC(rc);
-
-            return pStats;
-        }
-        AssertMsgFailed(("what! GCPhys=%RGp\n", GCPhys));
-        MMHyperFree(pVM, pStats);
-    }
-    IOM_UNLOCK_EXCL(pVM);
-    return NULL;
-}
-
-#endif /* VBOX_WITH_STATISTICS */
-
-/**
- * Registers a Memory Mapped I/O R3 handler.
- *
- * This API is called by PDM on behalf of a device. Devices must register ring-3 ranges
- * before any GC and R0 ranges can be registered using IOMR3MMIORegisterRC() and IOMR3MMIORegisterR0().
- *
- * @returns VBox status code.
- *
- * @param   pVM                 The cross context VM structure.
- * @param   pDevIns             PDM device instance owning the MMIO range.
- * @param   GCPhysStart         First physical address in the range.
- * @param   cbRange             The size of the range (in bytes).
- * @param   pvUser              User argument for the callbacks.
- * @param   pfnWriteCallback    Pointer to function which is gonna handle Write operations.
- * @param   pfnReadCallback     Pointer to function which is gonna handle Read operations.
- * @param   pfnFillCallback     Pointer to function which is gonna handle Fill/memset operations.
- * @param   fFlags              Flags, see IOMMMIO_FLAGS_XXX.
- * @param   pszDesc             Pointer to description string. This must not be freed.
- */
-VMMR3_INT_DECL(int)
-IOMR3MmioRegisterR3(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTHCPTR pvUser,
-                    R3PTRTYPE(PFNIOMMMIOWRITE) pfnWriteCallback, R3PTRTYPE(PFNIOMMMIOREAD) pfnReadCallback,
-                    R3PTRTYPE(PFNIOMMMIOFILL) pfnFillCallback, uint32_t fFlags, const char *pszDesc)
-{
-    LogFlow(("IOMR3MmioRegisterR3: pDevIns=%p GCPhysStart=%RGp cbRange=%RGp pvUser=%RHv pfnWriteCallback=%#x pfnReadCallback=%#x pfnFillCallback=%#x fFlags=%#x pszDesc=%s\n",
-             pDevIns, GCPhysStart, cbRange, pvUser, pfnWriteCallback, pfnReadCallback, pfnFillCallback, fFlags, pszDesc));
-    int rc;
-
-    /*
-     * Validate input.
-     */
-    AssertMsgReturn(GCPhysStart + (cbRange - 1) >= GCPhysStart,("Wrapped! %RGp LB %RGp\n", GCPhysStart, cbRange),
-                    VERR_IOM_INVALID_MMIO_RANGE);
-    AssertMsgReturn(   !(fFlags & ~(IOMMMIO_FLAGS_VALID_MASK & ~IOMMMIO_FLAGS_ABS))
-                    && (fFlags & IOMMMIO_FLAGS_READ_MODE)  <= IOMMMIO_FLAGS_READ_DWORD_QWORD
-                    && (fFlags & IOMMMIO_FLAGS_WRITE_MODE) <= IOMMMIO_FLAGS_WRITE_ONLY_DWORD_QWORD,
-                    ("%#x\n", fFlags),
-                    VERR_INVALID_PARAMETER);
-
-    /*
-     * Allocate new range record and initialize it.
-     */
-    PIOMMMIORANGE pRange;
-    rc = MMHyperAlloc(pVM, sizeof(*pRange), 0, MM_TAG_IOM, (void **)&pRange);
-    if (RT_SUCCESS(rc))
-    {
-        pRange->Core.Key            = GCPhysStart;
-        pRange->Core.KeyLast        = GCPhysStart + (cbRange - 1);
-        pRange->GCPhys              = GCPhysStart;
-        pRange->cb                  = cbRange;
-        pRange->cRefs               = 1; /* The tree reference. */
-        pRange->pszDesc             = pszDesc;
-
-        //pRange->pvUserR0            = NIL_RTR0PTR;
-        //pRange->pDevInsR0           = NIL_RTR0PTR;
-        //pRange->pfnReadCallbackR0   = NIL_RTR0PTR;
-        //pRange->pfnWriteCallbackR0  = NIL_RTR0PTR;
-        //pRange->pfnFillCallbackR0   = NIL_RTR0PTR;
-
-        //pRange->pvUserRC            = NIL_RTRCPTR;
-        //pRange->pDevInsRC           = NIL_RTRCPTR;
-        //pRange->pfnReadCallbackRC   = NIL_RTRCPTR;
-        //pRange->pfnWriteCallbackRC  = NIL_RTRCPTR;
-        //pRange->pfnFillCallbackRC   = NIL_RTRCPTR;
-
-        pRange->fFlags              = fFlags;
-
-        pRange->pvUserR3            = pvUser;
-        pRange->pDevInsR3           = pDevIns;
-        pRange->pfnReadCallbackR3   = pfnReadCallback;
-        pRange->pfnWriteCallbackR3  = pfnWriteCallback;
-        pRange->pfnFillCallbackR3   = pfnFillCallback;
-
-        /*
-         * Try register it with PGM and then insert it into the tree.
-         */
-        rc = PGMR3PhysMMIORegister(pVM, GCPhysStart, cbRange, pVM->iom.s.hMmioHandlerType,
-                                   pRange, MMHyperR3ToR0(pVM, pRange), MMHyperR3ToRC(pVM, pRange), pszDesc);
-        if (RT_SUCCESS(rc))
-        {
-            IOM_LOCK_EXCL(pVM);
-            if (RTAvlroGCPhysInsert(&pVM->iom.s.pTreesR3->MMIOTree, &pRange->Core))
-            {
-                iomR3FlushCache(pVM);
-                IOM_UNLOCK_EXCL(pVM);
-                return VINF_SUCCESS;
-            }
-
-            /* bail out */
-            IOM_UNLOCK_EXCL(pVM);
-            DBGFR3Info(pVM->pUVM, "mmio", NULL, NULL);
-            AssertMsgFailed(("This cannot happen!\n"));
-            rc = VERR_IOM_IOPORT_IPE_3;
-        }
-
-        MMHyperFree(pVM, pRange);
-    }
-    if (pDevIns->iInstance > 0)
-        MMR3HeapFree((void *)pszDesc);
-    return rc;
-}
-
-
-#if 0
-/**
- * Registers a Memory Mapped I/O RC handler range.
- *
- * This API is called by PDM on behalf of a device. Devices must first register ring-3 ranges
- * using IOMMMIORegisterR3() before calling this function.
- *
- *
- * @returns VBox status code.
- *
- * @param   pVM                 The cross context VM structure.
- * @param   pDevIns             PDM device instance owning the MMIO range.
- * @param   GCPhysStart         First physical address in the range.
- * @param   cbRange             The size of the range (in bytes).
- * @param   pvUser              User argument for the callbacks.
- * @param   pfnWriteCallback    Pointer to function which is gonna handle Write operations.
- * @param   pfnReadCallback     Pointer to function which is gonna handle Read operations.
- * @param   pfnFillCallback     Pointer to function which is gonna handle Fill/memset operations.
- * @thread  EMT
- */
-VMMR3_INT_DECL(int)
-IOMR3MmioRegisterRC(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTGCPTR pvUser,
-                    RCPTRTYPE(PFNIOMMMIOWRITE) pfnWriteCallback, RCPTRTYPE(PFNIOMMMIOREAD) pfnReadCallback,
-                    RCPTRTYPE(PFNIOMMMIOFILL) pfnFillCallback)
-{
-    LogFlow(("IOMR3MmioRegisterRC: pDevIns=%p GCPhysStart=%RGp cbRange=%RGp pvUser=%RGv pfnWriteCallback=%#x pfnReadCallback=%#x pfnFillCallback=%#x\n",
-             pDevIns, GCPhysStart, cbRange, pvUser, pfnWriteCallback, pfnReadCallback, pfnFillCallback));
-    AssertReturn(VM_IS_RAW_MODE_ENABLED(pVM), VERR_IOM_HM_IPE);
-
-    /*
-     * Validate input.
-     */
-    if (!pfnWriteCallback && !pfnReadCallback)
-    {
-        AssertMsgFailed(("No callbacks! %RGp LB %RGp\n", GCPhysStart, cbRange));
-        return VERR_INVALID_PARAMETER;
-    }
-    PVMCPU pVCpu = VMMGetCpu(pVM); Assert(pVCpu);
-
-    /*
-     * Find the MMIO range and check that the input matches.
-     */
-    IOM_LOCK_EXCL(pVM);
-    PIOMMMIORANGE pRange = iomMmioGetRange(pVM, pVCpu, GCPhysStart);
-    AssertReturnStmt(pRange, IOM_UNLOCK_EXCL(pVM), VERR_IOM_MMIO_RANGE_NOT_FOUND);
-    AssertReturnStmt(pRange->pDevInsR3 == pDevIns, IOM_UNLOCK_EXCL(pVM), VERR_IOM_NOT_MMIO_RANGE_OWNER);
-    AssertReturnStmt(pRange->GCPhys == GCPhysStart, IOM_UNLOCK_EXCL(pVM), VERR_IOM_INVALID_MMIO_RANGE);
-    AssertReturnStmt(pRange->cb == cbRange, IOM_UNLOCK_EXCL(pVM), VERR_IOM_INVALID_MMIO_RANGE);
-
-    pRange->pvUserRC          = pvUser;
-    pRange->pfnReadCallbackRC = pfnReadCallback;
-    pRange->pfnWriteCallbackRC= pfnWriteCallback;
-    pRange->pfnFillCallbackRC = pfnFillCallback;
-    pRange->pDevInsRC         = pDevIns->pDevInsForRC;
-    IOM_UNLOCK_EXCL(pVM);
-
-    return VINF_SUCCESS;
-}
-#endif
-
-
-/**
- * Registers a Memory Mapped I/O R0 handler range.
- *
- * This API is called by PDM on behalf of a device. Devices must first register ring-3 ranges
- * using IOMMR3MIORegisterHC() before calling this function.
- *
- *
- * @returns VBox status code.
- *
- * @param   pVM                 The cross context VM structure.
- * @param   pDevIns             PDM device instance owning the MMIO range.
- * @param   GCPhysStart         First physical address in the range.
- * @param   cbRange             The size of the range (in bytes).
- * @param   pvUser              User argument for the callbacks.
- * @param   pfnWriteCallback    Pointer to function which is gonna handle Write operations.
- * @param   pfnReadCallback     Pointer to function which is gonna handle Read operations.
- * @param   pfnFillCallback     Pointer to function which is gonna handle Fill/memset operations.
- * @thread  EMT
- */
-VMMR3_INT_DECL(int)
-IOMR3MmioRegisterR0(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTR0PTR pvUser,
-                    R0PTRTYPE(PFNIOMMMIOWRITE) pfnWriteCallback,
-                    R0PTRTYPE(PFNIOMMMIOREAD) pfnReadCallback,
-                    R0PTRTYPE(PFNIOMMMIOFILL) pfnFillCallback)
-{
-    LogFlow(("IOMR3MmioRegisterR0: pDevIns=%p GCPhysStart=%RGp cbRange=%RGp pvUser=%RHv pfnWriteCallback=%#x pfnReadCallback=%#x pfnFillCallback=%#x\n",
-             pDevIns, GCPhysStart, cbRange, pvUser, pfnWriteCallback, pfnReadCallback, pfnFillCallback));
-
-    /*
-     * Validate input.
-     */
-    if (!pfnWriteCallback && !pfnReadCallback)
-    {
-        AssertMsgFailed(("No callbacks! %RGp LB %RGp\n", GCPhysStart, cbRange));
-        return VERR_INVALID_PARAMETER;
-    }
-    PVMCPU pVCpu = VMMGetCpu(pVM); Assert(pVCpu);
-
-    /*
-     * Find the MMIO range and check that the input matches.
-     */
-    IOM_LOCK_EXCL(pVM);
-    PIOMMMIORANGE pRange = iomMmioGetRange(pVM, pVCpu, GCPhysStart);
-    AssertReturnStmt(pRange, IOM_UNLOCK_EXCL(pVM), VERR_IOM_MMIO_RANGE_NOT_FOUND);
-    AssertReturnStmt(pRange->pDevInsR3 == pDevIns, IOM_UNLOCK_EXCL(pVM), VERR_IOM_NOT_MMIO_RANGE_OWNER);
-    AssertReturnStmt(pRange->GCPhys == GCPhysStart, IOM_UNLOCK_EXCL(pVM), VERR_IOM_INVALID_MMIO_RANGE);
-    AssertReturnStmt(pRange->cb == cbRange, IOM_UNLOCK_EXCL(pVM), VERR_IOM_INVALID_MMIO_RANGE);
-
-    pRange->pvUserR0          = pvUser;
-    pRange->pfnReadCallbackR0 = pfnReadCallback;
-    pRange->pfnWriteCallbackR0= pfnWriteCallback;
-    pRange->pfnFillCallbackR0 = pfnFillCallback;
-    pRange->pDevInsR0         = pDevIns->pDevInsR0RemoveMe;
-    IOM_UNLOCK_EXCL(pVM);
-
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Deregisters a Memory Mapped I/O handler range.
- *
- * Registered GC, R0, and R3 ranges are affected.
- *
- * @returns VBox status code.
- *
- * @param   pVM                 The cross context VM structure.
- * @param   pDevIns             Device instance which the MMIO region is registered.
- * @param   GCPhysStart         First physical address (GC) in the range.
- * @param   cbRange             Number of bytes to deregister.
- *
- * @remark  This function mainly for PCI PnP Config and will not do
- *          all the checks you might expect it to do.
- */
-VMMR3_INT_DECL(int) IOMR3MmioDeregister(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange)
-{
-    LogFlow(("IOMR3MmioDeregister: pDevIns=%p GCPhysStart=%RGp cbRange=%RGp\n", pDevIns, GCPhysStart, cbRange));
-
-    /*
-     * Validate input.
-     */
-    RTGCPHYS GCPhysLast = GCPhysStart + (cbRange - 1);
-    if (GCPhysLast < GCPhysStart)
-    {
-        AssertMsgFailed(("Wrapped! %#x LB %RGp\n", GCPhysStart, cbRange));
-        return VERR_IOM_INVALID_MMIO_RANGE;
-    }
-    PVMCPU pVCpu = VMMGetCpu(pVM); Assert(pVCpu);
-
-    IOM_LOCK_EXCL(pVM);
-
-    /*
-     * Check ownership and such for the entire area.
-     */
-    RTGCPHYS GCPhys = GCPhysStart;
-    while (GCPhys <= GCPhysLast && GCPhys >= GCPhysStart)
-    {
-        PIOMMMIORANGE pRange = iomMmioGetRange(pVM, pVCpu, GCPhys);
-        if (!pRange)
-        {
-            IOM_UNLOCK_EXCL(pVM);
-            return VERR_IOM_MMIO_RANGE_NOT_FOUND;
-        }
-        AssertMsgReturnStmt(pRange->pDevInsR3 == pDevIns,
-                            ("Not owner! GCPhys=%RGp %RGp LB %RGp %s\n", GCPhys, GCPhysStart, cbRange, pRange->pszDesc),
-                            IOM_UNLOCK_EXCL(pVM),
-                            VERR_IOM_NOT_MMIO_RANGE_OWNER);
-        AssertMsgReturnStmt(pRange->Core.KeyLast <= GCPhysLast,
-                            ("Incomplete R3 range! GCPhys=%RGp %RGp LB %RGp %s\n", GCPhys, GCPhysStart, cbRange, pRange->pszDesc),
-                            IOM_UNLOCK_EXCL(pVM),
-                            VERR_IOM_INCOMPLETE_MMIO_RANGE);
-
-        /* next */
-        Assert(GCPhys <= pRange->Core.KeyLast);
-        GCPhys = pRange->Core.KeyLast + 1;
-    }
-
-    /*
-     * Do the actual removing of the MMIO ranges.
-     */
-    GCPhys = GCPhysStart;
-    while (GCPhys <= GCPhysLast && GCPhys >= GCPhysStart)
-    {
-        iomR3FlushCache(pVM);
-
-        PIOMMMIORANGE pRange = (PIOMMMIORANGE)RTAvlroGCPhysRemove(&pVM->iom.s.pTreesR3->MMIOTree, GCPhys);
-        Assert(pRange);
-        Assert(pRange->Core.Key == GCPhys && pRange->Core.KeyLast <= GCPhysLast);
-        IOM_UNLOCK_EXCL(pVM); /* Lock order fun. */
-
-        /* remove it from PGM */
-        int rc = PGMR3PhysMMIODeregister(pVM, GCPhys, pRange->cb);
-        AssertRC(rc);
-
-        IOM_LOCK_EXCL(pVM);
-
-        /* advance and free. */
-        GCPhys = pRange->Core.KeyLast + 1;
-        if (pDevIns->iInstance > 0)
-        {
-            void *pvDesc = ASMAtomicXchgPtr((void * volatile *)&pRange->pszDesc, NULL);
-            MMR3HeapFree(pvDesc);
-        }
-        iomMmioReleaseRange(pVM, pRange);
-    }
-
-    IOM_UNLOCK_EXCL(pVM);
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Notfication from PGM that the pre-registered MMIO region has been mapped into
- * user address space.
- *
- * @returns VBox status code.
- * @param   pVM             Pointer to the cross context VM structure.
- * @param   pvUser          The pvUserR3 argument of PGMR3PhysMMIOExPreRegister.
- * @param   GCPhys          The mapping address.
- * @remarks Called while owning the PGM lock.
- */
-VMMR3_INT_DECL(int) IOMR3MmioExNotifyMapped(PVM pVM, void *pvUser, RTGCPHYS GCPhys)
-{
-    PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
-    AssertReturn(pRange->GCPhys == NIL_RTGCPHYS, VERR_IOM_MMIO_IPE_1);
-
-    IOM_LOCK_EXCL(pVM);
-    Assert(pRange->GCPhys == NIL_RTGCPHYS);
-    pRange->GCPhys       = GCPhys;
-    pRange->Core.Key     = GCPhys;
-    pRange->Core.KeyLast = GCPhys + pRange->cb - 1;
-    if (RTAvlroGCPhysInsert(&pVM->iom.s.pTreesR3->MMIOTree, &pRange->Core))
-    {
-        iomR3FlushCache(pVM);
-        IOM_UNLOCK_EXCL(pVM);
-        return VINF_SUCCESS;
-    }
-    IOM_UNLOCK_EXCL(pVM);
-
-    AssertLogRelMsgFailed(("RTAvlroGCPhysInsert failed on %RGp..%RGp - %s\n", pRange->Core.Key, pRange->Core.KeyLast, pRange->pszDesc));
-    pRange->GCPhys       = NIL_RTGCPHYS;
-    pRange->Core.Key     = NIL_RTGCPHYS;
-    pRange->Core.KeyLast = NIL_RTGCPHYS;
-    return VERR_IOM_MMIO_IPE_2;
-}
-
-
-/**
- * Notfication from PGM that the pre-registered MMIO region has been unmapped
- * from user address space.
- *
- * @param   pVM             Pointer to the cross context VM structure.
- * @param   pvUser          The pvUserR3 argument of PGMR3PhysMMIOExPreRegister.
- * @param   GCPhys          The mapping address.
- * @remarks Called while owning the PGM lock.
- */
-VMMR3_INT_DECL(void) IOMR3MmioExNotifyUnmapped(PVM pVM, void *pvUser, RTGCPHYS GCPhys)
-{
-    PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
-    AssertLogRelReturnVoid(pRange->GCPhys == GCPhys);
-
-    IOM_LOCK_EXCL(pVM);
-    Assert(pRange->GCPhys == GCPhys);
-    PIOMMMIORANGE pRemoved = (PIOMMMIORANGE)RTAvlroGCPhysRemove(&pVM->iom.s.pTreesR3->MMIOTree, GCPhys);
-    if (pRemoved == pRange)
-    {
-        pRange->GCPhys       = NIL_RTGCPHYS;
-        pRange->Core.Key     = NIL_RTGCPHYS;
-        pRange->Core.KeyLast = NIL_RTGCPHYS;
-        iomR3FlushCache(pVM);
-        IOM_UNLOCK_EXCL(pVM);
-    }
-    else
-    {
-        if (pRemoved)
-            RTAvlroGCPhysInsert(&pVM->iom.s.pTreesR3->MMIOTree, &pRemoved->Core);
-        IOM_UNLOCK_EXCL(pVM);
-        AssertLogRelMsgFailed(("RTAvlroGCPhysRemove returned %p instead of %p for %RGp (%s)\n",
-                               pRemoved, pRange, GCPhys, pRange->pszDesc));
-    }
-}
-
-
-/**
- * Notfication from PGM that the pre-registered MMIO region has been mapped into
- * user address space.
- *
- * @param   pVM             Pointer to the cross context VM structure.
- * @param   pvUser          The pvUserR3 argument of PGMR3PhysMMIOExPreRegister.
- * @remarks Called while owning the PGM lock.
- */
-VMMR3_INT_DECL(void) IOMR3MmioExNotifyDeregistered(PVM pVM, void *pvUser)
-{
-    PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
-    AssertLogRelReturnVoid(pRange->GCPhys == NIL_RTGCPHYS);
-    iomMmioReleaseRange(pVM, pRange);
 }
 
Index: /trunk/src/VBox/VMM/VMMR3/IOMR3Mmio.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/IOMR3Mmio.cpp	(revision 82312)
+++ /trunk/src/VBox/VMM/VMMR3/IOMR3Mmio.cpp	(revision 82313)
@@ -514,47 +514,4 @@
 
 /**
- * Display a single MMIO range.
- *
- * @returns 0
- * @param   pNode   Pointer to MMIO R3 range.
- * @param   pvUser  Pointer to info output callback structure.
- */
-static DECLCALLBACK(int) iomR3MmioInfoOne(PAVLROGCPHYSNODECORE pNode, void *pvUser)
-{
-    PIOMMMIORANGE pRange = (PIOMMMIORANGE)pNode;
-    PCDBGFINFOHLP pHlp = (PCDBGFINFOHLP)pvUser;
-    pHlp->pfnPrintf(pHlp,
-                    "%RGp-%RGp %RHv %RHv %RHv %RHv %RHv %s\n",
-                    pRange->Core.Key,
-                    pRange->Core.KeyLast,
-                    pRange->pDevInsR3,
-                    pRange->pfnReadCallbackR3,
-                    pRange->pfnWriteCallbackR3,
-                    pRange->pfnFillCallbackR3,
-                    pRange->pvUserR3,
-                    pRange->pszDesc);
-    pHlp->pfnPrintf(pHlp,
-                    "%*s %RHv %RHv %RHv %RHv %RHv\n",
-                    sizeof(RTGCPHYS) * 2 * 2 + 1, "R0",
-                    pRange->pDevInsR0,
-                    pRange->pfnReadCallbackR0,
-                    pRange->pfnWriteCallbackR0,
-                    pRange->pfnFillCallbackR0,
-                    pRange->pvUserR0);
-#if 0
-    pHlp->pfnPrintf(pHlp,
-                    "%*s %RRv %RRv %RRv %RRv %RRv\n",
-                    sizeof(RTGCPHYS) * 2 * 2 + 1, "RC",
-                    pRange->pDevInsRC,
-                    pRange->pfnReadCallbackRC,
-                    pRange->pfnWriteCallbackRC,
-                    pRange->pfnFillCallbackRC,
-                    pRange->pvUserRC);
-#endif
-    return 0;
-}
-
-
-/**
  * Display all registered MMIO ranges.
  *
@@ -565,4 +522,6 @@
 DECLCALLBACK(void) iomR3MmioInfo(PVM pVM, PCDBGFINFOHLP pHlp, const char *pszArgs)
 {
+    RT_NOREF(pszArgs);
+
     /* No locking needed here as registerations are only happening during VMSTATE_CREATING. */
     pHlp->pfnPrintf(pHlp,
@@ -591,21 +550,4 @@
                             sizeof(RTGCPHYS) * 2, "unmapped", paRegs[i].pszDesc);
     }
-
-    /* Legacy registration: */
-    NOREF(pszArgs);
-    pHlp->pfnPrintf(pHlp,
-                    "MMIO ranges (pVM=%p)\n"
-                    "%.*s %.*s %.*s %.*s %.*s %.*s %s\n",
-                    pVM,
-                    sizeof(RTGCPHYS) * 4 + 1, "GC Phys Range                    ",
-                    sizeof(RTHCPTR) * 2,      "pDevIns         ",
-                    sizeof(RTHCPTR) * 2,      "Read            ",
-                    sizeof(RTHCPTR) * 2,      "Write           ",
-                    sizeof(RTHCPTR) * 2,      "Fill            ",
-                    sizeof(RTHCPTR) * 2,      "pvUser          ",
-                                              "Description");
-    IOM_LOCK_SHARED(pVM);
-    RTAvlroGCPhysDoWithAll(&pVM->iom.s.pTreesR3->MMIOTree, true, iomR3MmioInfoOne, (void *)pHlp);
-    IOM_UNLOCK_SHARED(pVM);
-}
-
+}
+
Index: /trunk/src/VBox/VMM/VMMR3/PDMDevHlp.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/PDMDevHlp.cpp	(revision 82312)
+++ /trunk/src/VBox/VMM/VMMR3/PDMDevHlp.cpp	(revision 82313)
@@ -59,16 +59,4 @@
 
 
-/**
- * Wrapper around PDMR3LdrGetSymbolR0Lazy.
- */
-DECLINLINE(int) pdmR3DevGetSymbolR0Lazy(PPDMDEVINS pDevIns, const char *pszSymbol, PRTR0PTR ppvValue)
-{
-    return PDMR3LdrGetSymbolR0Lazy(pDevIns->Internal.s.pVMR3,
-                                   pDevIns->Internal.s.pDevR3->pReg->pszR0Mod,
-                                   pDevIns->Internal.s.pDevR3->pszR0SearchPath,
-                                   pszSymbol, ppvValue);
-}
-
-
 /** @name R3 DevHlp
  * @{
@@ -225,162 +213,4 @@
     LogFlow(("pdmR3DevHlp_MmioGetMappingAddress: caller='%s'/%d: returns %RGp\n", pDevIns->pReg->szName, pDevIns->iInstance, GCPhys));
     return GCPhys;
-}
-
-
-/** @interface_method_impl{PDMDEVHLPR3,pfnMMIORegister} */
-static DECLCALLBACK(int) pdmR3DevHlp_MMIORegister(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTHCPTR pvUser,
-                                                  PFNIOMMMIOWRITE pfnWrite, PFNIOMMMIOREAD pfnRead, PFNIOMMMIOFILL pfnFill,
-                                                  uint32_t fFlags, const char *pszDesc)
-{
-    PDMDEV_ASSERT_DEVINS(pDevIns);
-    PVM pVM = pDevIns->Internal.s.pVMR3;
-    VM_ASSERT_EMT(pVM);
-    LogFlow(("pdmR3DevHlp_MMIORegister: caller='%s'/%d: GCPhysStart=%RGp cbRange=%RGp pvUser=%p pfnWrite=%p pfnRead=%p pfnFill=%p fFlags=%#x pszDesc=%p:{%s}\n",
-             pDevIns->pReg->szName, pDevIns->iInstance, GCPhysStart, cbRange, pvUser, pfnWrite, pfnRead, pfnFill, pszDesc, fFlags, pszDesc));
-
-    if (pDevIns->iInstance > 0)
-    {
-        char *pszDesc2 = MMR3HeapAPrintf(pVM, MM_TAG_PDM_DEVICE_DESC, "%s [%u]", pszDesc, pDevIns->iInstance);
-        if (pszDesc2)
-            pszDesc = pszDesc2;
-    }
-
-    int rc = IOMR3MmioRegisterR3(pVM, pDevIns, GCPhysStart, cbRange, pvUser,
-                                 pfnWrite, pfnRead, pfnFill, fFlags, pszDesc);
-
-    LogFlow(("pdmR3DevHlp_MMIORegister: caller='%s'/%d: returns %Rrc\n", pDevIns->pReg->szName, pDevIns->iInstance, rc));
-    return rc;
-}
-
-
-/** @interface_method_impl{PDMDEVHLPR3,pfnMMIORegisterRC} */
-static DECLCALLBACK(int) pdmR3DevHlp_MMIORegisterRC(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTRCPTR pvUser,
-                                                    const char *pszWrite, const char *pszRead, const char *pszFill)
-{
-    PDMDEV_ASSERT_DEVINS(pDevIns);
-    VM_ASSERT_EMT(pDevIns->Internal.s.pVMR3);
-    Assert(pDevIns->pReg->pszR0Mod[0]);
-    Assert(pDevIns->pReg->fFlags & PDM_DEVREG_FLAGS_R0);
-    LogFlow(("pdmR3DevHlp_MMIORegisterRC: caller='%s'/%d: GCPhysStart=%RGp cbRange=%RGp pvUser=%p pszWrite=%p:{%s} pszRead=%p:{%s} pszFill=%p:{%s}\n",
-             pDevIns->pReg->szName, pDevIns->iInstance, GCPhysStart, cbRange, pvUser, pszWrite, pszWrite, pszRead, pszRead, pszFill, pszFill));
-
-#if 0
-    /*
-     * Resolve the functions.
-     * Not all function have to present, leave it to IOM to enforce this.
-     */
-    int rc = VINF_SUCCESS;
-    if (   pDevIns->pReg->pszRCMod[0]
-        && (pDevIns->pReg->fFlags & PDM_DEVREG_FLAGS_RC)
-        && VM_IS_RAW_MODE_ENABLED(pDevIns->Internal.s.pVMR3))
-    {
-        RTRCPTR RCPtrWrite = NIL_RTRCPTR;
-        if (pszWrite)
-            rc = pdmR3DevGetSymbolRCLazy(pDevIns, pszWrite, &RCPtrWrite);
-
-        RTRCPTR RCPtrRead = NIL_RTRCPTR;
-        int rc2 = VINF_SUCCESS;
-        if (pszRead)
-            rc2 = pdmR3DevGetSymbolRCLazy(pDevIns, pszRead, &RCPtrRead);
-
-        RTRCPTR RCPtrFill = NIL_RTRCPTR;
-        int rc3 = VINF_SUCCESS;
-        if (pszFill)
-            rc3 = pdmR3DevGetSymbolRCLazy(pDevIns, pszFill, &RCPtrFill);
-
-        if (RT_SUCCESS(rc) && RT_SUCCESS(rc2) && RT_SUCCESS(rc3))
-            rc = IOMR3MmioRegisterRC(pDevIns->Internal.s.pVMR3, pDevIns, GCPhysStart, cbRange, pvUser, RCPtrWrite, RCPtrRead, RCPtrFill);
-        else
-        {
-            AssertMsgRC(rc,  ("Failed to resolve %s.%s (pszWrite)\n", pDevIns->pReg->pszRCMod, pszWrite));
-            AssertMsgRC(rc2, ("Failed to resolve %s.%s (pszRead)\n",  pDevIns->pReg->pszRCMod, pszRead));
-            AssertMsgRC(rc3, ("Failed to resolve %s.%s (pszFill)\n",  pDevIns->pReg->pszRCMod, pszFill));
-            if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
-                rc = rc2;
-            if (RT_FAILURE(rc3) && RT_SUCCESS(rc))
-                rc = rc3;
-        }
-    }
-    else if (VM_IS_RAW_MODE_ENABLED(pDevIns->Internal.s.pVMR3))
-    {
-        AssertMsgFailed(("No RC module for this driver!\n"));
-        rc = VERR_INVALID_PARAMETER;
-    }
-#else
-    int rc = VINF_SUCCESS;
-    RT_NOREF(pDevIns, GCPhysStart, cbRange, pvUser, pszWrite, pszRead, pszFill);
-#endif
-
-    LogFlow(("pdmR3DevHlp_MMIORegisterRC: caller='%s'/%d: returns %Rrc\n", pDevIns->pReg->szName, pDevIns->iInstance, rc));
-    return rc;
-}
-
-/** @interface_method_impl{PDMDEVHLPR3,pfnMMIORegisterR0} */
-static DECLCALLBACK(int) pdmR3DevHlp_MMIORegisterR0(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange, RTR0PTR pvUser,
-                                                    const char *pszWrite, const char *pszRead, const char *pszFill)
-{
-    PDMDEV_ASSERT_DEVINS(pDevIns);
-    VM_ASSERT_EMT(pDevIns->Internal.s.pVMR3);
-    Assert(pDevIns->pReg->pszR0Mod[0]);
-    Assert(pDevIns->pReg->fFlags & PDM_DEVREG_FLAGS_R0);
-    LogFlow(("pdmR3DevHlp_MMIORegisterHC: caller='%s'/%d: GCPhysStart=%RGp cbRange=%RGp pvUser=%p pszWrite=%p:{%s} pszRead=%p:{%s} pszFill=%p:{%s}\n",
-             pDevIns->pReg->szName, pDevIns->iInstance, GCPhysStart, cbRange, pvUser, pszWrite, pszWrite, pszRead, pszRead, pszFill, pszFill));
-
-    /*
-     * Resolve the functions.
-     * Not all function have to present, leave it to IOM to enforce this.
-     */
-    int rc = VINF_SUCCESS;
-    if (   pDevIns->pReg->pszR0Mod[0]
-        && (pDevIns->pReg->fFlags & PDM_DEVREG_FLAGS_R0))
-    {
-        R0PTRTYPE(PFNIOMMMIOWRITE) pfnR0PtrWrite = 0;
-        if (pszWrite)
-            rc = pdmR3DevGetSymbolR0Lazy(pDevIns, pszWrite, &pfnR0PtrWrite);
-        R0PTRTYPE(PFNIOMMMIOREAD) pfnR0PtrRead = 0;
-        int rc2 = VINF_SUCCESS;
-        if (pszRead)
-            rc2 = pdmR3DevGetSymbolR0Lazy(pDevIns, pszRead, &pfnR0PtrRead);
-        R0PTRTYPE(PFNIOMMMIOFILL) pfnR0PtrFill = 0;
-        int rc3 = VINF_SUCCESS;
-        if (pszFill)
-            rc3 = pdmR3DevGetSymbolR0Lazy(pDevIns, pszFill, &pfnR0PtrFill);
-        if (RT_SUCCESS(rc) && RT_SUCCESS(rc2) && RT_SUCCESS(rc3))
-            rc = IOMR3MmioRegisterR0(pDevIns->Internal.s.pVMR3, pDevIns, GCPhysStart, cbRange, pvUser,
-                                     pfnR0PtrWrite, pfnR0PtrRead, pfnR0PtrFill);
-        else
-        {
-            AssertMsgRC(rc,  ("Failed to resolve %s.%s (pszWrite)\n", pDevIns->pReg->pszR0Mod, pszWrite));
-            AssertMsgRC(rc2, ("Failed to resolve %s.%s (pszRead)\n",  pDevIns->pReg->pszR0Mod, pszRead));
-            AssertMsgRC(rc3, ("Failed to resolve %s.%s (pszFill)\n",  pDevIns->pReg->pszR0Mod, pszFill));
-            if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
-                rc = rc2;
-            if (RT_FAILURE(rc3) && RT_SUCCESS(rc))
-                rc = rc3;
-        }
-    }
-    else
-    {
-        AssertMsgFailed(("No R0 module for this driver!\n"));
-        rc = VERR_INVALID_PARAMETER;
-    }
-
-    LogFlow(("pdmR3DevHlp_MMIORegisterR0: caller='%s'/%d: returns %Rrc\n", pDevIns->pReg->szName, pDevIns->iInstance, rc));
-    return rc;
-}
-
-
-/** @interface_method_impl{PDMDEVHLPR3,pfnMMIODeregister} */
-static DECLCALLBACK(int) pdmR3DevHlp_MMIODeregister(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTGCPHYS cbRange)
-{
-    PDMDEV_ASSERT_DEVINS(pDevIns);
-    VM_ASSERT_EMT(pDevIns->Internal.s.pVMR3);
-    LogFlow(("pdmR3DevHlp_MMIODeregister: caller='%s'/%d: GCPhysStart=%RGp cbRange=%RGp\n",
-             pDevIns->pReg->szName, pDevIns->iInstance, GCPhysStart, cbRange));
-
-    int rc = IOMR3MmioDeregister(pDevIns->Internal.s.pVMR3, pDevIns, GCPhysStart, cbRange);
-
-    LogFlow(("pdmR3DevHlp_MMIODeregister: caller='%s'/%d: returns %Rrc\n", pDevIns->pReg->szName, pDevIns->iInstance, rc));
-    return rc;
 }
 
@@ -3989,8 +3819,4 @@
     pdmR3DevHlp_MmioReduce,
     pdmR3DevHlp_MmioGetMappingAddress,
-    pdmR3DevHlp_MMIORegister,
-    pdmR3DevHlp_MMIORegisterRC,
-    pdmR3DevHlp_MMIORegisterR0,
-    pdmR3DevHlp_MMIODeregister,
     pdmR3DevHlp_Mmio2Create,
     pdmR3DevHlp_Mmio2Destroy,
@@ -4475,8 +4301,4 @@
     pdmR3DevHlp_MmioReduce,
     pdmR3DevHlp_MmioGetMappingAddress,
-    pdmR3DevHlp_MMIORegister,
-    pdmR3DevHlp_MMIORegisterRC,
-    pdmR3DevHlp_MMIORegisterR0,
-    pdmR3DevHlp_MMIODeregister,
     pdmR3DevHlp_Mmio2Create,
     pdmR3DevHlp_Mmio2Destroy,
Index: /trunk/src/VBox/VMM/VMMR3/PGMPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/PGMPhys.cpp	(revision 82312)
+++ /trunk/src/VBox/VMM/VMMR3/PGMPhys.cpp	(revision 82313)
@@ -3172,10 +3172,4 @@
 
             /*
-             * Must tell IOM about MMIO (first one only).
-             */
-            if ((fFlags & (PGMREGMMIO2RANGE_F_MMIO2 | PGMREGMMIO2RANGE_F_FIRST_CHUNK)) == PGMREGMMIO2RANGE_F_FIRST_CHUNK)
-                IOMR3MmioExNotifyDeregistered(pVM, pCur->pPhysHandlerR3->pvUserR3);
-
-            /*
              * Unlink it
              */
@@ -3500,4 +3494,5 @@
     if (!(pFirstMmio->fFlags & PGMREGMMIO2RANGE_F_MMIO2))
     {
+        AssertFailed();
         int rc = VINF_SUCCESS;
         for (PPGMREGMMIO2RANGE pCurMmio = pFirstMmio; ; pCurMmio = pCurMmio->pNextR3)
@@ -3510,8 +3505,5 @@
             pCurMmio->fFlags |= PGMREGMMIO2RANGE_F_MAPPED; /* Use this to mark that the handler is registered. */
             if (pCurMmio->fFlags & PGMREGMMIO2RANGE_F_LAST_CHUNK)
-            {
-                rc = IOMR3MmioExNotifyMapped(pVM, pFirstMmio->pPhysHandlerR3->pvUserR3, GCPhys);
                 break;
-            }
         }
         if (RT_FAILURE(rc))
@@ -3644,4 +3636,6 @@
     if (!(fOldFlags & PGMREGMMIO2RANGE_F_MMIO2))
     {
+        AssertFailed();
+
         PPGMREGMMIO2RANGE pCurMmio = pFirstMmio;
         rc = pgmHandlerPhysicalExDeregister(pVM, pFirstMmio->pPhysHandlerR3, RT_BOOL(fOldFlags & PGMREGMMIO2RANGE_F_OVERLAPPING));
@@ -3653,6 +3647,4 @@
             AssertRCReturnStmt(rc, pgmUnlock(pVM), VERR_PGM_PHYS_MMIO_EX_IPE);
         }
-
-        IOMR3MmioExNotifyUnmapped(pVM, pFirstMmio->pPhysHandlerR3->pvUserR3, pFirstMmio->RamRange.GCPhys);
     }
 
Index: /trunk/src/VBox/VMM/include/IOMInline.h
===================================================================
--- /trunk/src/VBox/VMM/include/IOMInline.h	(revision 82312)
+++ /trunk/src/VBox/VMM/include/IOMInline.h	(revision 82313)
@@ -255,155 +255,4 @@
 #endif
 
-
-/**
- * Gets the MMIO range for the specified physical address in the current context.
- *
- * @returns Pointer to MMIO range.
- * @returns NULL if address not in a MMIO range.
- *
- * @param   pVM     The cross context VM structure.
- * @param   pVCpu   The cross context virtual CPU structure of the calling EMT.
- * @param   GCPhys  Physical address to lookup.
- */
-DECLINLINE(PIOMMMIORANGE) iomMmioGetRange(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
-{
-    Assert(IOM_IS_SHARED_LOCK_OWNER(pVM));
-    PIOMMMIORANGE pRange = pVCpu->iom.s.CTX_SUFF(pMMIORangeLast);
-    if (    !pRange
-        ||  GCPhys - pRange->GCPhys >= pRange->cb)
-        pVCpu->iom.s.CTX_SUFF(pMMIORangeLast) = pRange
-            = (PIOMMMIORANGE)RTAvlroGCPhysRangeGet(&pVM->iom.s.CTX_SUFF(pTrees)->MMIOTree, GCPhys);
-    return pRange;
-}
-
-/**
- * Retain a MMIO range.
- *
- * @param   pRange  The range to release.
- */
-DECLINLINE(void) iomMmioRetainRange(PIOMMMIORANGE pRange)
-{
-    uint32_t cRefs = ASMAtomicIncU32(&pRange->cRefs);
-    Assert(cRefs > 1);
-    Assert(cRefs < _1M);
-    NOREF(cRefs);
-}
-
-
-/**
- * Gets the referenced MMIO range for the specified physical address in the
- * current context.
- *
- * @returns Pointer to MMIO range.
- * @returns NULL if address not in a MMIO range.
- *
- * @param   pVM     The cross context VM structure.
- * @param   pVCpu   The cross context virtual CPU structure of the calling EMT.
- * @param   GCPhys  Physical address to lookup.
- */
-DECLINLINE(PIOMMMIORANGE) iomMmioGetRangeWithRef(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
-{
-    int rc = IOM_LOCK_SHARED_EX(pVM, VINF_SUCCESS);
-    AssertRCReturn(rc, NULL);
-
-    PIOMMMIORANGE pRange = pVCpu->iom.s.CTX_SUFF(pMMIORangeLast);
-    if (   !pRange
-        || GCPhys - pRange->GCPhys >= pRange->cb)
-        pVCpu->iom.s.CTX_SUFF(pMMIORangeLast) = pRange
-            = (PIOMMMIORANGE)RTAvlroGCPhysRangeGet(&pVM->iom.s.CTX_SUFF(pTrees)->MMIOTree, GCPhys);
-    if (pRange)
-        iomMmioRetainRange(pRange);
-
-    IOM_UNLOCK_SHARED(pVM);
-    return pRange;
-}
-
-
-/**
- * Releases a MMIO range.
- *
- * @param   pVM     The cross context VM structure.
- * @param   pRange  The range to release.
- */
-DECLINLINE(void) iomMmioReleaseRange(PVMCC pVM, PIOMMMIORANGE pRange)
-{
-    uint32_t cRefs = ASMAtomicDecU32(&pRange->cRefs);
-    if (!cRefs)
-        iomMmioFreeRange(pVM, pRange);
-}
-
-
-#ifdef VBOX_STRICT
-/**
- * Gets the MMIO range for the specified physical address in the current context.
- *
- * @returns Pointer to MMIO range.
- * @returns NULL if address not in a MMIO range.
- *
- * @param   pVM     The cross context VM structure.
- * @param   pVCpu   The cross context virtual CPU structure of the calling EMT.
- * @param   GCPhys  Physical address to lookup.
- */
-DECLINLINE(PIOMMMIORANGE) iomMMIOGetRangeUnsafe(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
-{
-    PIOMMMIORANGE pRange = pVCpu->iom.s.CTX_SUFF(pMMIORangeLast);
-    if (    !pRange
-        ||  GCPhys - pRange->GCPhys >= pRange->cb)
-        pVCpu->iom.s.CTX_SUFF(pMMIORangeLast) = pRange
-            = (PIOMMMIORANGE)RTAvlroGCPhysRangeGet(&pVM->iom.s.CTX_SUFF(pTrees)->MMIOTree, GCPhys);
-    return pRange;
-}
-#endif /* VBOX_STRICT */
-
-
-#ifdef VBOX_WITH_STATISTICS
-/**
- * Gets the MMIO statistics record.
- *
- * In ring-3 this will lazily create missing records, while in GC/R0 the caller has to
- * return the appropriate status to defer the operation to ring-3.
- *
- * @returns Pointer to MMIO stats.
- * @returns NULL if not found (R0/GC), or out of memory (R3).
- *
- * @param   pVM         The cross context VM structure.
- * @param   pVCpu       The cross context virtual CPU structure of the calling EMT.
- * @param   GCPhys      Physical address to lookup.
- * @param   pRange      The MMIO range.
- *
- * @remarks The caller holds the IOM critical section with shared access prior
- *          to calling this method.  Upon return, the lock has been released!
- *          This is ugly, but it's a necessary evil since we cannot upgrade read
- *          locks to write locks and the whole purpose here is calling
- *          iomR3MMIOStatsCreate.
- */
-DECLINLINE(PIOMMMIOSTATS) iomMmioGetStats(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, PIOMMMIORANGE pRange)
-{
-    Assert(IOM_IS_SHARED_LOCK_OWNER(pVM));
-
-    /* For large ranges, we'll put everything on the first byte. */
-    if (pRange->cb > PAGE_SIZE)
-        GCPhys = pRange->GCPhys;
-
-    PIOMMMIOSTATS pStats = pVCpu->iom.s.CTX_SUFF(pMMIOStatsLast);
-    if (    !pStats
-        ||  pStats->Core.Key != GCPhys)
-    {
-        pStats = (PIOMMMIOSTATS)RTAvloGCPhysGet(&pVM->iom.s.CTX_SUFF(pTrees)->MmioStatTree, GCPhys);
-# ifdef IN_RING3
-        if (!pStats)
-        {
-            IOM_UNLOCK_SHARED(pVM);
-            return iomR3MMIOStatsCreate(pVM, GCPhys, pRange->pszDesc);
-        }
-# endif
-    }
-
-    IOM_UNLOCK_SHARED(pVM);
-    return pStats;
-}
-#endif /* VBOX_WITH_STATISTICS */
-
-
 /** @}  */
 
Index: /trunk/src/VBox/VMM/include/IOMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/IOMInternal.h	(revision 82312)
+++ /trunk/src/VBox/VMM/include/IOMInternal.h	(revision 82313)
@@ -44,99 +44,4 @@
  * @{
  */
-
-/**
- * MMIO range descriptor.
- */
-typedef struct IOMMMIORANGE
-{
-    /** Avl node core with GCPhys as Key and GCPhys + cbSize - 1 as KeyLast. */
-    AVLROGCPHYSNODECORE         Core;
-    /** Start physical address. */
-    RTGCPHYS                    GCPhys;
-    /** Size of the range. */
-    RTGCPHYS                    cb;
-    /** The reference counter. */
-    uint32_t volatile           cRefs;
-    /** Flags, see IOMMMIO_FLAGS_XXX. */
-    uint32_t                    fFlags;
-
-    /** Pointer to user argument - R0. */
-    RTR0PTR                     pvUserR0;
-    /** Pointer to device instance - R0. */
-    PPDMDEVINSR0                pDevInsR0;
-    /** Pointer to write callback function - R0. */
-    R0PTRTYPE(PFNIOMMMIOWRITE)  pfnWriteCallbackR0;
-    /** Pointer to read callback function - R0. */
-    R0PTRTYPE(PFNIOMMMIOREAD)   pfnReadCallbackR0;
-    /** Pointer to fill (memset) callback function - R0. */
-    R0PTRTYPE(PFNIOMMMIOFILL)   pfnFillCallbackR0;
-
-    /** Pointer to user argument - R3. */
-    RTR3PTR                     pvUserR3;
-    /** Pointer to device instance - R3. */
-    PPDMDEVINSR3                pDevInsR3;
-    /** Pointer to write callback function - R3. */
-    R3PTRTYPE(PFNIOMMMIOWRITE)  pfnWriteCallbackR3;
-    /** Pointer to read callback function - R3. */
-    R3PTRTYPE(PFNIOMMMIOREAD)   pfnReadCallbackR3;
-    /** Pointer to fill (memset) callback function - R3. */
-    R3PTRTYPE(PFNIOMMMIOFILL)   pfnFillCallbackR3;
-
-    /** Description / Name. For easing debugging. */
-    R3PTRTYPE(const char *)     pszDesc;
-
-#if 0
-    /** Pointer to user argument - RC. */
-    RTRCPTR                     pvUserRC;
-    /** Pointer to device instance - RC. */
-    PPDMDEVINSRC                pDevInsRC;
-    /** Pointer to write callback function - RC. */
-    RCPTRTYPE(PFNIOMMMIOWRITE)  pfnWriteCallbackRC;
-    /** Pointer to read callback function - RC. */
-    RCPTRTYPE(PFNIOMMMIOREAD)   pfnReadCallbackRC;
-    /** Pointer to fill (memset) callback function - RC. */
-    RCPTRTYPE(PFNIOMMMIOFILL)   pfnFillCallbackRC;
-#if HC_ARCH_BITS == 64
-    /** Padding structure length to multiple of 8 bytes. */
-    RTRCPTR                     RCPtrPadding;
-#endif
-#endif
-} IOMMMIORANGE;
-/** Pointer to a MMIO range descriptor, R3 version. */
-typedef struct IOMMMIORANGE *PIOMMMIORANGE;
-
-
-/**
- * MMIO address statistics. (one address)
- *
- * This is a simple way of making on demand statistics, however it's a
- * bit free with the hypervisor heap memory.
- */
-typedef struct IOMMMIOSTATS
-{
-    /** Avl node core with the address as Key. */
-    AVLOGCPHYSNODECORE          Core;
-
-    /** Number of accesses (subtract ReadRZToR3 and WriteRZToR3 to get the right
-     *  number). */
-    STAMCOUNTER                 Accesses;
-
-    /** Profiling read handler overhead in R3. */
-    STAMPROFILE                 ProfReadR3;
-    /** Profiling write handler overhead in R3. */
-    STAMPROFILE                 ProfWriteR3;
-    /** Counting and profiling reads in R0/RC. */
-    STAMPROFILE                 ProfReadRZ;
-    /** Counting and profiling writes in R0/RC. */
-    STAMPROFILE                 ProfWriteRZ;
-
-    /** Number of reads to this address from R0/RC which was serviced in R3. */
-    STAMCOUNTER                 ReadRZToR3;
-    /** Number of writes to this address from R0/RC which was serviced in R3. */
-    STAMCOUNTER                 WriteRZToR3;
-} IOMMMIOSTATS;
-AssertCompileMemberAlignment(IOMMMIOSTATS, Accesses, 8);
-/** Pointer to I/O port statistics. */
-typedef IOMMMIOSTATS *PIOMMMIOSTATS;
 
 /**
@@ -405,23 +310,4 @@
 
 
-
-/**
- * The IOM trees.
- *
- * These are offset based the nodes and root must be in the same
- * memory block in HC. The locations of IOM structure and the hypervisor heap
- * are quite different in R3, R0 and RC.
- */
-typedef struct IOMTREES
-{
-    /** Tree containing the MMIO range descriptors (IOMMMIORANGE). */
-    AVLROGCPHYSTREE         MMIOTree;
-    /** Tree containing MMIO statistics (IOMMMIOSTATS). */
-    AVLOGCPHYSTREE          MmioStatTree;
-} IOMTREES;
-/** Pointer to the IOM trees. */
-typedef IOMTREES *PIOMTREES;
-
-
 /**
  * IOM per virtual CPU instance data.
@@ -487,11 +373,5 @@
      * @note pretty static as only used by APIC on AMD-V.  */
     uint16_t                            idxMmioLastPhysHandler;
-    uint16_t                            u16Padding;
-
-    R3PTRTYPE(PIOMMMIORANGE)        pMMIORangeLastR3;
-    R3PTRTYPE(PIOMMMIOSTATS)        pMMIOStatsLastR3;
-
-    R0PTRTYPE(PIOMMMIORANGE)        pMMIORangeLastR0;
-    R0PTRTYPE(PIOMMMIOSTATS)        pMMIOStatsLastR0;
+    uint16_t                            au16Padding[3];
     /** @} */
 } IOMCPU;
@@ -505,14 +385,4 @@
 typedef struct IOM
 {
-    /** Pointer to the trees - R3 ptr. */
-    R3PTRTYPE(PIOMTREES)            pTreesR3;
-    /** Pointer to the trees - R0 ptr. */
-    R0PTRTYPE(PIOMTREES)            pTreesR0;
-
-    /** MMIO physical access handler type.   */
-    PGMPHYSHANDLERTYPE              hMmioHandlerType;
-    /** MMIO physical access handler type, new style.   */
-    PGMPHYSHANDLERTYPE              hNewMmioHandlerType;
-
     /** @name I/O ports
      * @note The updating of these variables is done exclusively from EMT(0).
@@ -544,4 +414,6 @@
      * @note The updating of these variables is done exclusively from EMT(0).
      * @{ */
+    /** MMIO physical access handler type, new style.   */
+    PGMPHYSHANDLERTYPE              hNewMmioHandlerType;
     /** Number of MMIO registrations. */
     uint32_t                        cMmioRegs;
@@ -692,7 +564,5 @@
 RT_C_DECLS_BEGIN
 
-void                iomMmioFreeRange(PVMCC pVM, PIOMMMIORANGE pRange);
 #ifdef IN_RING3
-PIOMMMIOSTATS       iomR3MMIOStatsCreate(PVM pVM, RTGCPHYS GCPhys, const char *pszDesc);
 DECLCALLBACK(void)  iomR3IoPortInfo(PVM pVM, PCDBGFINFOHLP pHlp, const char *pszArgs);
 void                iomR3IoPortRegStats(PVM pVM, PIOMIOPORTENTRYR3 pRegEntry);
@@ -707,12 +577,8 @@
 void                iomR0MmioInitPerVMData(PGVM pGVM);
 #endif
-VBOXSTRICTRC        iomMmioCommonPfHandlerOld(PVMCC pVM, PVMCPUCC pVCpu, uint32_t uErrorCode, PCPUMCTXCORE pCtxCore,
-                                              RTGCPHYS GCPhysFault, void *pvUser);
 
 #ifndef IN_RING3
-DECLEXPORT(FNPGMRZPHYSPFHANDLER)    iomMmioPfHandler;
 DECLEXPORT(FNPGMRZPHYSPFHANDLER)    iomMmioPfHandlerNew;
 #endif
-PGM_ALL_CB2_PROTO(FNPGMPHYSHANDLER) iomMmioHandler;
 PGM_ALL_CB2_PROTO(FNPGMPHYSHANDLER) iomMmioHandlerNew;
 
