Re: [PATCH] xen/x86/hvm: Propagate emulated CR2 writes to the VMCB

[Roger Pau Monné <roger@xxxxxxxxxxxxxx>]

On Tue, Oct 20, 2026 at 02:33:15PM -0700, Stefano Stabellini wrote:
> hvmemul_write_cr() updates guest_cr[2] but, unlike every other writer of
> it, doesn't call hvm_update_guest_cr(). On SVM, CR2 is loaded from
> the VMCB, so the emulated write never reaches the guest, and the next
> VMExit overwrites guest_cr[2] with the stale VMCB value.
> 
> Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxx>

Acked-by: Roger Pau Monné <roger@xxxxxxxxxxxxxx>

I wonder whether there's more missing here, see below.

> ---
>  xen/arch/x86/hvm/emulate.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
> index c09ea002ec..cd2831d34b 100644
> --- a/xen/arch/x86/hvm/emulate.c
> +++ b/xen/arch/x86/hvm/emulate.c
> @@ -2350,6 +2350,7 @@ static int cf_check hvmemul_write_cr(
>  
>      case 2:
>          curr->arch.hvm.guest_cr[2] = val;
> +        hvm_update_guest_cr(curr, 2);

Looking at hvm_update_cr(), is this possibly also missing a call to
nestedhvm_set_cr()?

Thanks, Roger.