xen/x86/hvm: Propagate emulated CR2 writes to the VMCB

hvmemul_write_cr() updates guest_cr[2] but, unlike every other writer of
it, doesn't call hvm_update_guest_cr(). On SVM, CR2 is loaded from
the VMCB, so the emulated write never reaches the guest, and the next
VMExit overwrites guest_cr[2] with the stale VMCB value.

Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Acked-by: Roger Pau Monné <roger@xenproject.org>

xen/arch/x86/hvm/emulate.c

@@ -2350,6 +2350,7 @@ static int cf_check hvmemul_write_cr(
 
     case 2:
         curr->arch.hvm.guest_cr[2] = val;
+        hvm_update_guest_cr(curr, 2);
         rc = X86EMUL_OKAY;
         break;