[mzs]

good find:

    @@ -2189,6 +2190,11 @@
             *msr_content = vcpu_vlapic(v)->hw.apic_base_msr;
             break;
     
    +    case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0x3ff:
    +        if ( hvm_x2apic_msr_read(v, msr, msr_content) )
    +            goto gp_fault;
    +        break;
    +
         case MSR_IA32_CR_PAT:
             *msr_content = v->arch.hvm_vcpu.pat_cr;
             break;
    @@ -2296,6 +2302,11 @@
             vlapic_msr_set(vcpu_vlapic(v), msr_content);
             break;
     
    +    case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0x3ff:
    +        if ( hvm_x2apic_msr_write(v, msr, msr_content) )
    +            goto gp_fault;
    +        break;
    +
         case MSR_IA32_CR_PAT:
             if ( !pat_msr_set(&v->arch.hvm_vcpu.pat_cr, msr_content) )
                goto gp_fault;

[diydsp]

What is the "..." operator? I have never seen that before. I can't find any references to it. Is that a macro specific to this project? [I checked the post above, but it doesn't match this source code exactly (and doesn't have ... as an operator).]

[_delirium]

It's a GNU extension that lets you define ranges in switch statements' cases: https://gcc.gnu.org/onlinedocs/gcc/Case-Ranges.html

[walterbell]

Is this from the Intel Xen+KVM team, crediting the patch to a member of the RedHat KVM team?

Since KVM isn't vulnerable to this cross-domain issue, it may be useful to compare with the equivalent code in KVM and/or Linux.