diff -r 304a37519d11 -r 8afcb103a82e src/cpu/kvm/base.cc
--- a/src/cpu/kvm/base.cc	Mon Jun 03 13:55:41 2013 +0200
+++ b/src/cpu/kvm/base.cc	Mon Jun 03 14:30:31 2013 +0200
@@ -46,6 +46,7 @@
 #include <csignal>
 #include <ostream>
 
+#include "arch/mmapped_ipr.hh"
 #include "arch/utility.hh"
 #include "cpu/kvm/base.hh"
 #include "debug/Checkpoint.hh"
@@ -805,12 +806,32 @@
 Tick
 BaseKvmCPU::doMMIOAccess(Addr paddr, void *data, int size, bool write)
 {
+    ThreadContext *tc(thread->getTC());
+    syncThreadContext();
+
     mmio_req.setPhys(paddr, size, Request::UNCACHEABLE, dataMasterId());
+    // Some architectures do need to massage physical addresses a bit
+    // before they are inserted into the memory system. This enables
+    // APIC accesses on x86 and m5ops where supported through a MMIO
+    // interface.
+    BaseTLB::Mode tlb_mode(write ? BaseTLB::Write : BaseTLB::Read);
+    Fault fault(tc->getDTBPtr()->finalizePhysical(&mmio_req, tc, tlb_mode));
+    if (fault != NoFault)
+        warn("Finalization of MMIO address failed: %s\n", fault->name());
+
 
     const MemCmd cmd(write ? MemCmd::WriteReq : MemCmd::ReadReq);
     Packet pkt(&mmio_req, cmd);
     pkt.dataStatic(data);
-    return dataPort.sendAtomic(&pkt);
+
+    if (mmio_req.isMmappedIpr()) {
+        if (write)
+            return TheISA::handleIprWrite(tc, &pkt);
+        else
+            return TheISA::handleIprRead(tc, &pkt);
+    } else {
+        return dataPort.sendAtomic(&pkt);
+    }
 }
 
 int
diff -r 304a37519d11 -r 8afcb103a82e src/mem/request.hh
--- a/src/mem/request.hh	Mon Jun 03 13:55:41 2013 +0200
+++ b/src/mem/request.hh	Mon Jun 03 14:30:31 2013 +0200
@@ -321,15 +321,15 @@
     }
 
     /**
-     * Set just the physical address.  This should only be used to
-     * record the result of a translation, and thus the vaddr must be
-     * valid before this method is called.  Otherwise, use setPhys()
-     * to guarantee that the size and flags are also set.
+     * Set just the physical address.  This usually used to record the
+     * result of a translation. However, when using virtualized CPUs
+     * setPhys() is sometimes called to finalize a physical address
+     * without a virtual address, so we can't check if the virtual
+     * address is valid.
      */
     void
     setPaddr(Addr paddr)
     {
-        assert(privateFlags.isSet(VALID_VADDR));
         _paddr = paddr;
         privateFlags.set(VALID_PADDR);
     }