So I don't particularly like this #if check here. IMHO this should be done in arch-specific function that you call from here that is just empty for ARM. It could be a static inline function as it's rather small.
 

+#if CONFIG_X86

+        if ( VM_EVENT_X86_CR3 == mop->u.mov_to_cr.index )
+        {
+            struct vcpu *v;
+            /* Latches new CR3 mask through CR0 code. */
+            for_each_vcpu ( d, v )
+                hvm_update_guest_cr(v, 0);
+        }
+#endif

I agree, but I was actually hoping to approach that in a future ARM-patch I'm going to send after this one.
On ARM, that part of code (where hypervisor CR trapping is enabled based on write_ctrlreg_enabled bits)
is done in another place (on the scheduling tail). I wanted to approach removing that #ifdef and finding maybe
a solution to do that similarly for X86. Would it be ok to leave this for that discussion? It would be simpler to illustrate
what I have in mind.