[PATCH] xen/x86/hvm: Propagate emulated CR2 writes to the VMCB

[PATCH] xen/x86/hvm: Propagate emulated CR2 writes to the VMCB

[Stefano Stabellini]

hvmemul_write_cr() updates guest_cr[2] but, unlike every other writer of
it, doesn't call hvm_update_guest_cr(). On SVM, CR2 is loaded from
the VMCB, so the emulated write never reaches the guest, and the next
VMExit overwrites guest_cr[2] with the stale VMCB value.

Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
---
 xen/arch/x86/hvm/emulate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
index c09ea002ec..cd2831d34b 100644
--- a/xen/arch/x86/hvm/emulate.c
+++ b/xen/arch/x86/hvm/emulate.c
@@ -2350,6 +2350,7 @@ static int cf_check hvmemul_write_cr(
 
     case 2:
         curr->arch.hvm.guest_cr[2] = val;
+        hvm_update_guest_cr(curr, 2);
         rc = X86EMUL_OKAY;
         break;
 
-- 
2.43.0

Re: [PATCH] xen/x86/hvm: Propagate emulated CR2 writes to the VMCB

[Roger Pau Monné]

On Tue, Oct 20, 2026 at 02:33:15PM -0700, Stefano Stabellini wrote:
> hvmemul_write_cr() updates guest_cr[2] but, unlike every other writer of
> it, doesn't call hvm_update_guest_cr(). On SVM, CR2 is loaded from
> the VMCB, so the emulated write never reaches the guest, and the next
> VMExit overwrites guest_cr[2] with the stale VMCB value.
> 
> Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>

Acked-by: Roger Pau Monné <roger@xenproject.org>

I wonder whether there's more missing here, see below.

> ---
>  xen/arch/x86/hvm/emulate.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
> index c09ea002ec..cd2831d34b 100644
> --- a/xen/arch/x86/hvm/emulate.c
> +++ b/xen/arch/x86/hvm/emulate.c
> @@ -2350,6 +2350,7 @@ static int cf_check hvmemul_write_cr(
>  
>      case 2:
>          curr->arch.hvm.guest_cr[2] = val;
> +        hvm_update_guest_cr(curr, 2);

Looking at hvm_update_cr(), is this possibly also missing a call to
nestedhvm_set_cr()?

Thanks, Roger.

Re: [PATCH] xen/x86/hvm: Propagate emulated CR2 writes to the VMCB

[Ross Lagerwall]

On 10/21/26 9:19 AM, Roger Pau Monné wrote:
> On Tue, Oct 20, 2026 at 02:33:15PM -0700, Stefano Stabellini wrote:
>> hvmemul_write_cr() updates guest_cr[2] but, unlike every other writer of
>> it, doesn't call hvm_update_guest_cr(). On SVM, CR2 is loaded from
>> the VMCB, so the emulated write never reaches the guest, and the next
>> VMExit overwrites guest_cr[2] with the stale VMCB value.
>>
>> Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
> 
> Acked-by: Roger Pau Monné <roger@xenproject.org>
> 
> I wonder whether there's more missing here, see below.
> 
>> ---
>>   xen/arch/x86/hvm/emulate.c | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
>> index c09ea002ec..cd2831d34b 100644
>> --- a/xen/arch/x86/hvm/emulate.c
>> +++ b/xen/arch/x86/hvm/emulate.c
>> @@ -2350,6 +2350,7 @@ static int cf_check hvmemul_write_cr(
>>   
>>       case 2:
>>           curr->arch.hvm.guest_cr[2] = val;
>> +        hvm_update_guest_cr(curr, 2);
> 
> Looking at hvm_update_cr(), is this possibly also missing a call to
> nestedhvm_set_cr()?

AFAIK the values set by nestedhvm_set_cr() are not used at all with nested SVM
and from a brief look may only be used for CR0 and CR4 for VVMX. So maybe it is
not needed, though for consistency I think it would make sense to replace both
lines with a single call to hvm_update_cr().

Ross

Re: [PATCH] xen/x86/hvm: Propagate emulated CR2 writes to the VMCB

[Roger Pau Monné]

On Wed, Oct 21, 2026 at 02:11:30PM +0100, Ross Lagerwall wrote:
> On 10/21/26 9:19 AM, Roger Pau Monné wrote:
> > On Tue, Oct 20, 2026 at 02:33:15PM -0700, Stefano Stabellini wrote:
> > > hvmemul_write_cr() updates guest_cr[2] but, unlike every other writer of
> > > it, doesn't call hvm_update_guest_cr(). On SVM, CR2 is loaded from
> > > the VMCB, so the emulated write never reaches the guest, and the next
> > > VMExit overwrites guest_cr[2] with the stale VMCB value.
> > > 
> > > Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
> > 
> > Acked-by: Roger Pau Monné <roger@xenproject.org>
> > 
> > I wonder whether there's more missing here, see below.
> > 
> > > ---
> > >   xen/arch/x86/hvm/emulate.c | 1 +
> > >   1 file changed, 1 insertion(+)
> > > 
> > > diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
> > > index c09ea002ec..cd2831d34b 100644
> > > --- a/xen/arch/x86/hvm/emulate.c
> > > +++ b/xen/arch/x86/hvm/emulate.c
> > > @@ -2350,6 +2350,7 @@ static int cf_check hvmemul_write_cr(
> > >       case 2:
> > >           curr->arch.hvm.guest_cr[2] = val;
> > > +        hvm_update_guest_cr(curr, 2);
> > 
> > Looking at hvm_update_cr(), is this possibly also missing a call to
> > nestedhvm_set_cr()?
> 
> AFAIK the values set by nestedhvm_set_cr() are not used at all with nested SVM
> and from a brief look may only be used for CR0 and CR4 for VVMX. So maybe it is
> not needed, though for consistency I think it would make sense to replace both
> lines with a single call to hvm_update_cr().

Yes, however at the time being hvm_update_cr() is static to hvm.c.
It would mean exporting the function, which maybe we should have done
in the first place instead of exporting hvm_update_guest_cr()?

Thanks, Roger.

Re: [PATCH] xen/x86/hvm: Propagate emulated CR2 writes to the VMCB

[Jan Beulich]

On 20.10.2026 23:33, Stefano Stabellini wrote:
> hvmemul_write_cr() updates guest_cr[2] but, unlike every other writer of
> it, doesn't call hvm_update_guest_cr(). On SVM, CR2 is loaded from
> the VMCB, so the emulated write never reaches the guest, and the next
> VMExit overwrites guest_cr[2] with the stale VMCB value.
> 
> Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>

Especially as this looks to affect not just (or even not at all) nested,
I think there should have been a Fixes: tag here. I see the change was
already committed without, but I think this wants backporting nevertheless.

Jan