On 27/07/2018 18:48, Jim Mattson wrote: > On a physical machine, I would expect the default local APIC page to > fall in the PCI hole, so it would be correct to sink writes and to > return all ones for reads. Does qemu implement a PCI hole, and does > this address fall into it? It does implement a PCI hole, but when using the kernel LAPIC it expects that only devices write to that range; therefore that address doesn't fall into the PCI hole, and instead it generates an MSIs. Paolo