diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 17d38260fa..15c2bf1867 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -771,6 +771,9 @@ static void do_cpu_reset(void *opaque)
                         env->cp15.scr_el3 |= SCR_ENTP2;
                         env->vfp.smcr_el[3] = 0xf;
                     }
+                    if (cpu_isar_feature(aa64_hcx, cpu)) {
+                        env->cp15.scr_el3 |= SCR_HXEN;
+                    }
                     /* AArch64 kernels never boot in secure mode */
                     assert(!info->secure_boot);
                     /* This hook is only supported for AArch32 currently: