From e4d90abb26a814ae6f33ce6aa66c9095aa5cae5f Mon Sep 17 00:00:00 2001 From: Stefano Stabellini Date: Tue, 20 Oct 2026 14:33:15 -0700 Subject: [PATCH] xen/x86/hvm: Propagate emulated CR2 writes to the VMCB MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hvmemul_write_cr() updates guest_cr[2] but, unlike every other writer of it, doesn't call hvm_update_guest_cr(). On SVM, CR2 is loaded from the VMCB, so the emulated write never reaches the guest, and the next VMExit overwrites guest_cr[2] with the stale VMCB value. Signed-off-by: Stefano Stabellini Acked-by: Roger Pau Monné --- xen/arch/x86/hvm/emulate.c | 1 + 1 file changed, 1 insertion(+) diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index c09ea002ec..cd2831d34b 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -2350,6 +2350,7 @@ static int cf_check hvmemul_write_cr( case 2: curr->arch.hvm.guest_cr[2] = val; + hvm_update_guest_cr(curr, 2); rc = X86EMUL_OKAY; break;