I tried virsh command, it seems CR3 value returns by qemu and dmesg by a c program in Guest is not same ? The command is : virsh -c qemu:///system qemu-monitor-command instance-0000009d '{"execute": "human-monitor-command", "arguments": {"command-line": "info registers"}}'
When Guest is 4GB, CR3 in guest is like "cr3 = 0x39a54000", while qemu returns "cr3 = 0x0000000139a54000", with a gap of 4GB(0x0000000100000000). When Guest is 8GB, CR3 in guest is like "cr3 = 0x39a54000", while qemu returns "cr3 = 0x0000000239a54000", with a gap of 8GB(0x0000000200000000). So, it seems that CR3qemu = PysicalMem + CR3guest. Is it a bug?