X-Git-Url: http://v3vee.org/palacios/gitweb/gitweb.cgi?a=blobdiff_plain;f=palacios%2Fsrc%2Fpalacios%2Fvmm_ctrl_regs.c;h=2fcd3b640ef6fd633440afe75ab4a6f383f9b49f;hb=aad69eda8e2354cf146054e57ad25fe201a1cb52;hp=91b0fc2bd161fce1ab963683b2f9773e5bd180b6;hpb=e9bfcdfa725b34d81c48d713adf9d173f3168951;p=palacios.git

diff --git a/palacios/src/palacios/vmm_ctrl_regs.c b/palacios/src/palacios/vmm_ctrl_regs.c
index 91b0fc2..2fcd3b6 100644
--- a/palacios/src/palacios/vmm_ctrl_regs.c
+++ b/palacios/src/palacios/vmm_ctrl_regs.c
@@ -7,8 +7,6 @@
 
 
 
-extern void SerialMemDump(unsigned char *start, int n);
-
 /* Segmentation is a problem here...
  *
  * When we get a memory operand, presumably we use the default segment (which is?) 
@@ -16,309 +14,120 @@ extern void SerialMemDump(unsigned char *start, int n);
  */
 
 
-int handle_cr0_write(struct guest_info * info) {
-  char instr[15];
-  
-  
-  switch (info->cpu_mode) { 
-  case REAL: 
-    {
-      int index = 0;
-      int ret;
-      
-      PrintDebug("Real Mode write to CR0 at linear guest pa 0x%x\n",get_addr_linear(info,info->rip,&(info->segments.cs)));
-
-      // The real rip address is actually a combination of the rip + CS base 
-      ret = read_guest_pa_memory(info, get_addr_linear(info, info->rip, &(info->segments.cs)), 15, instr);
-      if (ret != 15) {
-	// I think we should inject a GPF into the guest
-	PrintDebug("Could not read instruction (ret=%d)\n", ret);
-	return -1;
-      }
+#ifndef DEBUG_CTRL_REGS
+#undef PrintDebug
+#define PrintDebug(fmt, args...)
+#endif
 
-      while (is_prefix_byte(instr[index])) {
-	index++; 
-      }
 
-      if ((instr[index] == cr_access_byte) && 
-	  (instr[index + 1] == lmsw_byte) && 
-	  (MODRM_REG(instr[index + 2]) == lmsw_reg_byte)) {
- 
-	addr_t first_operand;
-	addr_t second_operand;
-	struct cr0_real *real_cr0;
-	struct cr0_real *new_cr0;
-	operand_type_t addr_type;
-	char new_cr0_val = 0;
-	// LMSW
-	// decode mod/RM
-	index += 2;
- 
-	real_cr0 = (struct cr0_real*)&(info->ctrl_regs.cr0);
 
-	addr_type = decode_operands16(&(info->vm_regs), instr + index, &index, &first_operand, &second_operand, REG16);
 
 
-	if (addr_type == REG_OPERAND) {
-	  new_cr0 = (struct cr0_real *)first_operand;
-	} else if (addr_type == MEM_OPERAND) {
-	  addr_t host_addr;
 
-	  if (guest_pa_to_host_va(info, first_operand + (info->segments.ds.base << 4), &host_addr) == -1) {
-	    // gpf the guest
-	    return -1;
-	  }
 
-	  new_cr0 = (struct cr0_real *)host_addr;
-	} else {
-	  PrintDebug("Memory operand in real mode write to CR0 is UNIMPLEMENTED\n");
-	  // error... don't know what to do
-	  return -1;
-	}
-		 
-	if ((new_cr0->pe == 1) && (real_cr0->pe == 0)) {
-	  info->cpu_mode = PROTECTED;
-	} else if ((new_cr0->pe == 0) && (real_cr0->pe == 1)) {
-	  info->cpu_mode = REAL;
-	}
-      
-	new_cr0_val = *(char*)(new_cr0) & 0x0f;
+int handle_cr0_write(struct guest_info * info) {
+  char instr[15];
+  int ret;
+  struct x86_instr dec_instr;
 
+  if (info->mem_mode == PHYSICAL_MEM) { 
+    ret = read_guest_pa_memory(info, get_addr_linear(info, info->rip, &(info->segments.cs)), 15, instr);
+  } else { 
+    ret = read_guest_va_memory(info, get_addr_linear(info, info->rip, &(info->segments.cs)), 15, instr);
+  }
 
-	if (info->shdw_pg_mode == SHADOW_PAGING) {
-	  struct cr0_real * shadow_cr0 = (struct cr0_real*)&(info->shdw_pg_state.guest_cr0);
-
-	  PrintDebug("Old CR0=%x, Old Shadow CR0=%x\n", *real_cr0, *shadow_cr0);	
-	  /* struct cr0_real is only 4 bits wide, 
-	   * so we can overwrite the real_cr0 without worrying about the shadow fields
-	   */
-	  *(char*)real_cr0 &= 0xf0;
-	  *(char*)real_cr0 |= new_cr0_val;
-	
-	  *(char*)shadow_cr0 &= 0xf0;
-	  *(char*)shadow_cr0 |= new_cr0_val;
+  if (ret != 15) {
+    // I think we should inject a GPF into the guest
+    PrintError("Could not read instruction (ret=%d)\n", ret);
+    return -1;
+  }
 
-	  PrintDebug("New CR0=%x, New Shadow CR0=%x\n", *real_cr0, *shadow_cr0);	
-	} else {
-	  PrintDebug("Old CR0=%x\n", *real_cr0);	
-	  // for now we just pass through....
-	  *(char*)real_cr0 &= 0xf0;
-	  *(char*)real_cr0 |= new_cr0_val;
+  if (v3_decode(info, (addr_t)instr, &dec_instr) == -1) {
+    PrintError("Could not decode instruction\n");
+    return -1;
+  }
 
-	  PrintDebug("New CR0=%x\n", *real_cr0);	
-	}
 
+  if (opcode_cmp(V3_OPCODE_LMSW, (const uchar_t *)(dec_instr.opcode)) == 0) {
+    struct cr0_real *real_cr0  = (struct cr0_real*)&(info->ctrl_regs.cr0);
+    struct cr0_real *new_cr0 = (struct cr0_real *)(dec_instr.first_operand.operand);	
+    uchar_t new_cr0_val;
 
-	info->rip += index;
+    PrintDebug("LMSW\n");
 
-      } else if ((instr[index] == cr_access_byte) && 
-		 (instr[index + 1] == clts_byte)) {
-	// CLTS
-	PrintDebug("CLTS unhandled in CR0 write\n");
-	return -1;
+    new_cr0_val = (*(char*)(new_cr0)) & 0x0f;
+    
+    PrintDebug("OperandVal = %x\n", new_cr0_val);
 
-      } else if ((instr[index] == cr_access_byte) && 
-		 (instr[index + 1] = mov_to_cr_byte)) {
-	addr_t first_operand;
-	addr_t second_operand;
-	struct cr0_32 *real_cr0;
-	struct cr0_32 *new_cr0;
-	operand_type_t addr_type;
-     
+    PrintDebug("Old CR0=%x\n", *real_cr0);	
+    *(uchar_t*)real_cr0 &= 0xf0;
+    *(uchar_t*)real_cr0 |= new_cr0_val;
+    PrintDebug("New CR0=%x\n", *real_cr0);	
       
-	index += 2;
- 
-	real_cr0 = (struct cr0_32*)&(info->ctrl_regs.cr0);
-
-	addr_type = decode_operands16(&(info->vm_regs), instr + index, &index, &first_operand, &second_operand, REG32);
 
-	if (addr_type != REG_OPERAND) {
-	  PrintDebug("Moving to CR0 from non-register operand in CR0 write\n");
-	  /* Mov to CR0 Can only be a 32 bit register */
-	  // FIX ME
-	  return -1;
-	}
-
-	new_cr0 = (struct cr0_32 *)first_operand;
-
-	if (new_cr0->pe == 1) {
-	  PrintDebug("Entering Protected Mode\n");
-	  info->cpu_mode = PROTECTED;
-	}
-
-	if (new_cr0->pe == 0) { 
-	  PrintDebug("Entering Real Mode\n");
-	  info->cpu_mode = REAL;
-	}
-	  
-
-	if (new_cr0->pg == 1) {
-	  PrintDebug("Paging is already turned on in switch to protected mode in CR0 write\n");
-
-	  // GPF the guest??
-	  return -1;
-	}
-
-	if (info->shdw_pg_mode == SHADOW_PAGING) {
-	  struct cr0_32 * shadow_cr0 = (struct cr0_32 *)&(info->shdw_pg_state.guest_cr0);
-	
-	  PrintDebug("Old CR0=%x, Old Shadow CR0=%x\n", *real_cr0, *shadow_cr0);	
-	  *real_cr0 = *new_cr0;
-	  real_cr0->pg = 1;
-
-	  *shadow_cr0 = *new_cr0;
-
-	  PrintDebug("New CR0=%x, New Shadow CR0=%x\n", *real_cr0, *shadow_cr0);	
-	} else {
-	  PrintDebug("Old CR0=%x\n", *real_cr0);	
-	  *real_cr0 = *new_cr0;
-	  PrintDebug("New CR0=%x\n", *real_cr0);	
-	}
-
-	info->rip += index;
-
-      } else {
-	PrintDebug("Unsupported Instruction\n");
-	// unsupported instruction, UD the guest
-	return -1;
-      }
+    if (info->shdw_pg_mode == SHADOW_PAGING) {
+      struct cr0_real * shadow_cr0 = (struct cr0_real*)&(info->shdw_pg_state.guest_cr0);
+      
+      PrintDebug(" Old Shadow CR0=%x\n", *shadow_cr0);	
+      *(uchar_t*)shadow_cr0 &= 0xf0;
+      *(uchar_t*)shadow_cr0 |= new_cr0_val;
+      PrintDebug("New Shadow CR0=%x\n", *shadow_cr0);	
+    }
+  } else if (opcode_cmp(V3_OPCODE_MOV2CR, (const uchar_t *)(dec_instr.opcode)) == 0) {
+    PrintDebug("MOV2CR0\n");
 
-    } 
-    break;
- 
-  case PROTECTED: 
-    {
+    if (info->cpu_mode == LONG) {
+      // 64 bit registers
+    } else {
+      // 32 bit registers
+	struct cr0_32 *real_cr0 = (struct cr0_32*)&(info->ctrl_regs.cr0);
+	struct cr0_32 *new_cr0= (struct cr0_32 *)(dec_instr.second_operand.operand);
 
-      int index = 0;
-      int ret;
+	PrintDebug("OperandVal = %x, length=%d\n", *new_cr0, dec_instr.first_operand.size);
 
-      PrintDebug("Protected %s Mode write to CR0 at guest %s linear rip 0x%x\n", 
-		 info->mem_mode == VIRTUAL_MEM ? "Paged" : "",
-		 info->mem_mode == VIRTUAL_MEM ? "virtual" : "",
-		 get_addr_linear(info, info->rip, &(info->segments.cs)));
 
-      // OK, now we will read the instruction
-      // The only difference between PROTECTED and PROTECTED_PG is whether we read
-      // from guest_pa or guest_va
-      if (info->mem_mode == PHYSICAL_MEM) { 
-	// The real rip address is actually a combination of the rip + CS base 
-	ret = read_guest_pa_memory(info, get_addr_linear(info, info->rip, &(info->segments.cs)), 15, instr);
-      } else { 
-	ret = read_guest_va_memory(info, get_addr_linear(info, info->rip, &(info->segments.cs)), 15, instr);
-      }
+	PrintDebug("Old CR0=%x\n", *real_cr0);
+	*real_cr0 = *new_cr0;
 	
 
-      if (ret != 15) {
-	// I think we should inject a GPF into the guest
-	PrintDebug("Could not read instruction (ret=%d)\n", ret);
-	return -1;
-      }
-
-      while (is_prefix_byte(instr[index])) {
-	index++; 
-      }
-
-      struct cr0_32 * shadow_cr0 = (struct cr0_32 *)&(info->shdw_pg_state.guest_cr0);
-
-      struct cr0_32 * real_cr0 = (struct cr0_32*)&(info->ctrl_regs.cr0);
-
-      if ((instr[index] == cr_access_byte) && 
-	  (instr[index + 1] == mov_to_cr_byte)) {
-
-	// MOV to CR0
-    
-	addr_t first_operand;
-	addr_t second_operand;
-	struct cr0_32 *new_cr0;
-	operand_type_t addr_type;
-
-	index += 2;
- 
-
-	addr_type = decode_operands32(&(info->vm_regs), instr + index, &index, &first_operand, &second_operand, REG32);
-
-	if (addr_type != REG_OPERAND) {
-	  PrintDebug("Non-register operand in write to CR0\n");
-	  return -1;
-	}
-
-	new_cr0 = (struct cr0_32 *)first_operand;
-
-
-
-	if (info->shdw_pg_mode == SHADOW_PAGING) {
-	  struct cr0_32 * shadow_cr0 = (struct cr0_32 *)&(info->shdw_pg_state.guest_cr0);
-
-	  if (new_cr0->pg == 1){
-	    // This should be new_cr0->pg && !(old_cr->pg), right?
-	    // and then a case for turning paging off?
-
-	    struct cr3_32 * shadow_cr3 = (struct cr3_32 *)&(info->shdw_pg_state.shadow_cr3);
-
-	    info->mem_mode = VIRTUAL_MEM;
+ 	if (info->shdw_pg_mode == SHADOW_PAGING) {
+ 	  struct cr0_32 * shadow_cr0 = (struct cr0_32 *)&(info->shdw_pg_state.guest_cr0);
 	  
-	    *shadow_cr0 = *new_cr0;
-	    *real_cr0 = *new_cr0;
-
-	    //
-	    // Activate Shadow Paging
-	    //
-	    PrintDebug("Turning on paging in the guest\n");
-
-	    info->ctrl_regs.cr3 = *(addr_t*)shadow_cr3;
+ 	  PrintDebug("Old Shadow CR0=%x\n", *shadow_cr0);	
 	  
-
-	  } else if (new_cr0->pe == 0) {
-	    info->cpu_mode = REAL;
-
-	    *shadow_cr0 = *new_cr0;
-	    *real_cr0 = *new_cr0;
+ 	  real_cr0->et = 1;
+	  
+ 	  *shadow_cr0 = *new_cr0;
+ 	  shadow_cr0->et = 1;
+	  
+	  if (get_mem_mode(info) == VIRTUAL_MEM) {
+	    struct cr3_32 * shadow_cr3 = (struct cr3_32 *)&(info->shdw_pg_state.shadow_cr3);
+	    
+	    info->ctrl_regs.cr3 = *(addr_t*)shadow_cr3;
+	  } else  {
+	    info->ctrl_regs.cr3 = *(addr_t*)&(info->direct_map_pt);
 	    real_cr0->pg = 1;
 	  }
-
-
-	} else {
-	  *real_cr0 = *new_cr0;
-	}
-
-	info->rip += index;
-
-      } else if ((instr[index] == 0x0f) &&
-		 (instr[index + 1] == 0x06)) { 
-	// CLTS instruction
-	PrintDebug("CLTS instruction - clearing TS flag of real and shadow CR0\n");
-	shadow_cr0->ts=0;
-	real_cr0->ts=0;
-	
-	index+=2;
-	
-	info->rip+=index;
-
-      } else {
-	PrintDebug("Unkown instruction: \n");
-	SerialMemDump(instr,15);
-	return -1;
-      }
+	  
+	  PrintDebug("New Shadow CR0=%x\n",*shadow_cr0);
+ 	}
+	PrintDebug("New CR0=%x\n", *real_cr0);
     }
-    break;
-    
-  case PROTECTED_PAE:
-    PrintDebug("Protected PAE Mode write to CR0 is UNIMPLEMENTED\n");
-    return -1;
 
-  case LONG:
-    PrintDebug("Protected Long Mode write to CR0 is UNIMPLEMENTED\n");
-    return -1;
+  } else if (opcode_cmp(V3_OPCODE_CLTS, (const uchar_t *)(dec_instr.opcode)) == 0) {
+    // CLTS
+    struct cr0_32 *real_cr0 = (struct cr0_32*)&(info->ctrl_regs.cr0);
+	
+    real_cr0->ts = 0;
 
-  default: 
-    {
-      PrintDebug("Unknown Mode write to CR0 (info->cpu_mode=0x%x\n)",info->cpu_mode);
-      return -1;
+    if (info->shdw_pg_mode == SHADOW_PAGING) {
+      struct cr0_32 * shadow_cr0 = (struct cr0_32 *)&(info->shdw_pg_state.guest_cr0);
+      shadow_cr0->ts = 0;
     }
-    break;
-
   }
 
+  info->rip += dec_instr.instr_length;
+
   return 0;
 }
 
@@ -335,6 +144,7 @@ int handle_cr0_read(struct guest_info * info) {
       int ret;
 
       PrintDebug("Real Mode read from CR0 at linear guest pa 0x%x\n",get_addr_linear(info,info->rip,&(info->segments.cs)));
+      //PrintV3Segments(info);
 
       // The real rip address is actually a combination of the rip + CS base 
       ret = read_guest_pa_memory(info, get_addr_linear(info, info->rip, &(info->segments.cs)), 15, instr);
@@ -346,9 +156,28 @@ int handle_cr0_read(struct guest_info * info) {
 
 
       while (is_prefix_byte(instr[index])) {
+	switch(instr[index]) {
+	case PREFIX_CS_OVERRIDE:
+	case PREFIX_SS_OVERRIDE:
+	case PREFIX_DS_OVERRIDE:
+	case PREFIX_ES_OVERRIDE:
+	case PREFIX_FS_OVERRIDE:
+	case PREFIX_GS_OVERRIDE:
+	  PrintDebug("Segment Override!!\n");
+	  return -1;
+	  break;
+	default:
+	  break;
+	}
 	index++; 
       }
 
+      /*
+	while (is_prefix_byte(instr[index])) {
+	index++; 
+	}
+      */
+
       if ((instr[index] == cr_access_byte) && 
 	  (instr[index + 1] == smsw_byte) && 
 	  (MODRM_REG(instr[index + 2]) == smsw_reg_byte)) {
@@ -422,6 +251,8 @@ int handle_cr0_read(struct guest_info * info) {
 	  *virt_cr0 = *real_cr0;
 	}
 
+	PrintDebug("Returning CR0: %x\n", *virt_cr0);
+
 	info->rip += index;
 
       } else {
@@ -454,6 +285,12 @@ int handle_cr0_read(struct guest_info * info) {
 	ret = read_guest_va_memory(info, get_addr_linear(info, info->rip, &(info->segments.cs)), 15, instr);
       }
 
+
+      /*
+	PrintDebug("Instr (15 bytes) at %x:\n", instr);
+	PrintTraceMemDump((char*)instr, 15);
+      */
+
       if (ret != 15) {
 	// I think we should inject a GPF into the guest
 	PrintDebug("Could not read Protected %s mode instruction (ret=%d)\n", 
@@ -461,11 +298,31 @@ int handle_cr0_read(struct guest_info * info) {
 	return -1;
       }
 
+
       while (is_prefix_byte(instr[index])) {
+	switch(instr[index]) {
+	case PREFIX_CS_OVERRIDE:
+	case PREFIX_SS_OVERRIDE:
+	case PREFIX_DS_OVERRIDE:
+	case PREFIX_ES_OVERRIDE:
+	case PREFIX_FS_OVERRIDE:
+	case PREFIX_GS_OVERRIDE:
+	  PrintDebug("Segment Override!!\n");
+	  return -1;
+	  break;
+	default:
+	  break;
+	}
 	index++; 
       }
 
 
+      /*
+	while (is_prefix_byte(instr[index])) {
+	index++; 
+	}
+      */
+
       if ((instr[index] == cr_access_byte) &&
 	  (instr[index+1] == mov_from_cr_byte)) {
 	
@@ -490,12 +347,17 @@ int handle_cr0_read(struct guest_info * info) {
 
 	if (info->shdw_pg_mode == SHADOW_PAGING) {
 	  *virt_cr0 = *(struct cr0_32 *)&(info->shdw_pg_state.guest_cr0);
-	  if (info->cpu_mode==PROTECTED) {
-	    virt_cr0->pg=0; // clear the pg bit because guest doesn't think it's on
+	  
+	  if (info->mem_mode == PHYSICAL_MEM) {
+	    virt_cr0->pg = 0; // clear the pg bit because guest doesn't think it's on
 	  }
+	  
 	} else {
 	  *virt_cr0 = *real_cr0;
 	}
+
+	  PrintDebug("real CR0: %x\n", *(uint_t*)real_cr0);
+	  PrintDebug("returned CR0: %x\n", *(uint_t*)virt_cr0);
       
 	info->rip += index;
 
@@ -531,7 +393,131 @@ int handle_cr0_read(struct guest_info * info) {
 
 
 int handle_cr3_write(struct guest_info * info) {
-  if (info->cpu_mode == PROTECTED) {
+  if (info->cpu_mode == REAL) {
+    // WHAT THE HELL DOES THIS EVEN MEAN?????
+
+    int index = 0;
+    int ret;
+    char instr[15];
+
+    PrintDebug("Real Mode Write to CR3.\n");
+    // We need to read the instruction, which is at CS:IP, but that 
+    // linear address is guest physical without PG and guest virtual with PG
+
+    ret = read_guest_pa_memory(info, get_addr_linear(info, info->rip, &(info->segments.cs)), 15, instr);
+
+    if (ret != 15) {
+      PrintDebug("Could not read instruction (ret=%d)\n", ret);
+      return -1;
+    }
+
+    while (is_prefix_byte(instr[index])) {
+      switch(instr[index]) {
+      case PREFIX_CS_OVERRIDE:
+      case PREFIX_SS_OVERRIDE:
+      case PREFIX_DS_OVERRIDE:
+      case PREFIX_ES_OVERRIDE:
+      case PREFIX_FS_OVERRIDE:
+      case PREFIX_GS_OVERRIDE:
+	PrintDebug("Segment Override!!\n");
+	return -1;
+	break;
+      default:
+	break;
+      }
+      index++; 
+    }
+    
+
+    if ((instr[index] == cr_access_byte) && 
+	(instr[index + 1] == mov_to_cr_byte)) {
+
+      addr_t first_operand;
+      addr_t second_operand;
+      struct cr3_32 * new_cr3;
+      //      struct cr3_32 * real_cr3;
+      operand_type_t addr_type;
+
+      index += 2;
+
+      addr_type = decode_operands16(&(info->vm_regs), instr + index, &index, &first_operand, &second_operand, REG32);
+
+      if (addr_type != REG_OPERAND) {
+	/* Mov to CR3 can only be a 32 bit register */
+	return -1;
+      }
+
+      new_cr3 = (struct cr3_32 *)first_operand;
+
+      if (info->shdw_pg_mode == SHADOW_PAGING) {
+	int flushed=0;
+	addr_t shadow_pt;
+	struct cr3_32 * shadow_cr3 = (struct cr3_32 *)&(info->shdw_pg_state.shadow_cr3);
+	struct cr3_32 * guest_cr3 = (struct cr3_32 *)&(info->shdw_pg_state.guest_cr3);
+
+	/*
+
+	  if (CR3_TO_PDE32(*(uint_t*)shadow_cr3) != 0) {
+	    PrintDebug("Shadow Page Table\n");
+	    PrintDebugPageTables((pde32_t *)CR3_TO_PDE32(*(uint_t*)shadow_cr3));
+	  }
+	*/
+
+	/* Delete the current Page Tables */
+	if (!CR3_32_SAME_BASE(new_cr3,guest_cr3)) { 
+	  PrintDebug("New CR3 is different - flushing shadow page table\n");
+	  delete_page_tables_pde32((pde32_t *)CR3_TO_PDE32(*(uint_t*)shadow_cr3));
+	  flushed=1;
+	} else {
+	  PrintDebug("New CR3 (0x%x) has same base as previous CR3 (0x%x) - reusing shadow page table\n", *((uint_t*)new_cr3), *((uint_t*)guest_cr3));
+	}
+
+	PrintDebug("Old Shadow CR3=%x; Old Guest CR3=%x\n", 
+		   *(uint_t*)shadow_cr3, *(uint_t*)guest_cr3);
+
+
+	*guest_cr3 = *new_cr3;
+
+
+	if (flushed) { 
+	  // Something like this
+	  shadow_pt =  create_new_shadow_pt32(info);
+	  //shadow_pt = setup_shadow_pt32(info, CR3_TO_PDE32(*(addr_t *)new_cr3));
+	} else {
+	  shadow_pt = shadow_cr3->pdt_base_addr<<12;
+	}
+
+	/* Copy Various flags */
+	*shadow_cr3 = *new_cr3;
+
+	/*
+	{
+	  addr_t tmp_addr;
+	  guest_pa_to_host_va(info, ((*(uint_t*)guest_cr3) & 0xfffff000), &tmp_addr);
+	  PrintDebug("Guest PD\n");
+	  PrintPD32((pde32_t *)tmp_addr);
+
+	}
+	*/
+
+	
+	shadow_cr3->pdt_base_addr = PD32_BASE_ADDR(shadow_pt);
+
+	PrintDebug("New Shadow CR3=%x; New Guest CR3=%x\n", 
+		   *(uint_t*)shadow_cr3, *(uint_t*)guest_cr3);
+
+      }
+      info->rip += index;
+
+    } else {
+      PrintDebug("Unknown Instruction\n");
+      PrintTraceMemDump(instr,15);
+      return -1;
+    }
+
+
+
+  } else if (info->cpu_mode == PROTECTED) {
     int index = 0;
     int ret;
     char instr[15];
@@ -545,10 +531,10 @@ int handle_cr3_write(struct guest_info * info) {
     // linear address is guest physical without PG and guest virtual with PG
     if (info->mem_mode == PHYSICAL_MEM) { 
       // The real rip address is actually a combination of the rip + CS base 
-      PrintDebug("Writing Guest CR3 Write (Physical Address)\n");
+      //PrintDebug("Writing Guest CR3 Write (Physical Address)\n");
       ret = read_guest_pa_memory(info, get_addr_linear(info, info->rip, &(info->segments.cs)), 15, instr);
     } else { 
-      PrintDebug("Writing Guest CR3 Write (Virtual Address)\n");
+      //PrintDebug("Writing Guest CR3 Write (Virtual Address)\n");
       // The real rip address is actually a combination of the rip + CS base 
       ret = read_guest_va_memory(info, get_addr_linear(info, info->rip, &(info->segments.cs)), 15, instr);
     }
@@ -557,10 +543,29 @@ int handle_cr3_write(struct guest_info * info) {
       PrintDebug("Could not read instruction (ret=%d)\n", ret);
       return -1;
     }
-    
+
     while (is_prefix_byte(instr[index])) {
-      index++;
+      switch(instr[index]) {
+      case PREFIX_CS_OVERRIDE:
+      case PREFIX_SS_OVERRIDE:
+      case PREFIX_DS_OVERRIDE:
+      case PREFIX_ES_OVERRIDE:
+      case PREFIX_FS_OVERRIDE:
+      case PREFIX_GS_OVERRIDE:
+	PrintDebug("Segment Override!!\n");
+	return -1;
+	break;
+      default:
+	break;
+      }
+      index++; 
     }
+    
+    /*    
+	  while (is_prefix_byte(instr[index])) {
+	  index++;
+	  }
+    */
 
     if ((instr[index] == cr_access_byte) && 
 	(instr[index + 1] == mov_to_cr_byte)) {
@@ -583,13 +588,27 @@ int handle_cr3_write(struct guest_info * info) {
       new_cr3 = (struct cr3_32 *)first_operand;
 
       if (info->shdw_pg_mode == SHADOW_PAGING) {
+	int flushed=0;
 	addr_t shadow_pt;
 	struct cr3_32 * shadow_cr3 = (struct cr3_32 *)&(info->shdw_pg_state.shadow_cr3);
 	struct cr3_32 * guest_cr3 = (struct cr3_32 *)&(info->shdw_pg_state.guest_cr3);
 
 
+	/*
+	  if (CR3_TO_PDE32(*(uint_t*)shadow_cr3) != 0) {
+	    PrintDebug("Shadow Page Table\n");
+	    PrintDebugPageTables((pde32_t *)CR3_TO_PDE32(*(uint_t*)shadow_cr3));
+	  }
+	*/
+
 	/* Delete the current Page Tables */
-	delete_page_tables_pde32((pde32_t *)CR3_TO_PDE32(*(uint_t*)shadow_cr3));
+	if (!CR3_32_SAME_BASE(guest_cr3,new_cr3)) { 
+	  PrintDebug("New CR3 is different - flushing shadow page table\n");
+	  delete_page_tables_pde32((pde32_t *)CR3_TO_PDE32(*(uint_t*)shadow_cr3));
+	  flushed=1;
+	} else {
+	  PrintDebug("New CR3 (0x%x) has same base as previous CR3 (0x%x) - reusing shadow page table\n",*((uint_t*)new_cr3), *((uint_t*)guest_cr3));
+	}
 
 	PrintDebug("Old Shadow CR3=%x; Old Guest CR3=%x\n", 
 		   *(uint_t*)shadow_cr3, *(uint_t*)guest_cr3);
@@ -597,15 +616,27 @@ int handle_cr3_write(struct guest_info * info) {
 
 	*guest_cr3 = *new_cr3;
 
+	if (flushed) { 
+	  // Something like this
+	  shadow_pt =  create_new_shadow_pt32(info);
+	  //shadow_pt = setup_shadow_pt32(info, CR3_TO_PDE32(*(addr_t *)new_cr3));
+	} else {
+	  shadow_pt =shadow_cr3->pdt_base_addr << 12;
+	}
 
 
-	// Something like this
-	shadow_pt =  create_new_shadow_pt32(info);
-	//shadow_pt = setup_shadow_pt32(info, CR3_TO_PDE32(*(addr_t *)new_cr3));
-
 	/* Copy Various flags */
 	*shadow_cr3 = *new_cr3;
 
+	/*
+	{
+	  addr_t tmp_addr;
+	  guest_pa_to_host_va(info, ((*(uint_t*)guest_cr3) & 0xfffff000), &tmp_addr);
+	  PrintDebug("Guest PD\n");
+	  PrintPD32((pde32_t *)tmp_addr);
+
+	}
+	*/
 
 	
 	shadow_cr3->pdt_base_addr = PD32_BASE_ADDR(shadow_pt);
@@ -625,7 +656,7 @@ int handle_cr3_write(struct guest_info * info) {
 
     } else {
       PrintDebug("Unknown Instruction\n");
-      SerialMemDump(instr,15);
+      PrintTraceMemDump(instr,15);
       return -1;
     }
   } else {
@@ -640,7 +671,80 @@ int handle_cr3_write(struct guest_info * info) {
 
 
 int handle_cr3_read(struct guest_info * info) {
-  if (info->cpu_mode == PROTECTED) {
+
+  if (info->cpu_mode == REAL) {
+    char instr[15];
+    int ret;
+    int index = 0;
+    addr_t linear_addr = 0;
+
+    linear_addr = get_addr_linear(info, info->rip, &(info->segments.cs));
+
+    
+    //PrintDebug("RIP Linear: %x\n", linear_addr);
+    //PrintV3Segments(info);
+    
+    ret = read_guest_pa_memory(info, linear_addr, 15, instr);
+
+    if (ret != 15) {
+      PrintDebug("Could not read instruction (ret=%d)\n", ret);
+      return -1;
+    }
+    
+    while (is_prefix_byte(instr[index])) {
+      switch(instr[index]) {
+      case PREFIX_CS_OVERRIDE:
+      case PREFIX_SS_OVERRIDE:
+      case PREFIX_DS_OVERRIDE:
+      case PREFIX_ES_OVERRIDE:
+      case PREFIX_FS_OVERRIDE:
+      case PREFIX_GS_OVERRIDE:
+	PrintDebug("Segment Override!!\n");
+	return -1;
+	break;
+      default:
+	break;
+      }
+      index++; 
+    }
+
+
+    if ((instr[index] == cr_access_byte) && 
+	(instr[index + 1] == mov_from_cr_byte)) {
+      addr_t first_operand;
+      addr_t second_operand;
+      struct cr3_32 * virt_cr3;
+      struct cr3_32 * real_cr3 = (struct cr3_32 *)&(info->ctrl_regs.cr3);
+      operand_type_t addr_type;
+
+      index += 2;
+
+      addr_type = decode_operands16(&(info->vm_regs), instr + index, &index, &first_operand, &second_operand, REG32);
+
+      if (addr_type != REG_OPERAND) {
+	/* Mov to CR3 can only be a 32 bit register */
+	return -1;
+      }
+
+      virt_cr3 = (struct cr3_32 *)first_operand;
+
+      if (info->shdw_pg_mode == SHADOW_PAGING) {
+	*virt_cr3 = *(struct cr3_32 *)&(info->shdw_pg_state.guest_cr3);
+      } else {
+	*virt_cr3 = *real_cr3;
+      }
+      
+      info->rip += index;
+    } else {
+      PrintDebug("Unknown Instruction\n");
+      PrintTraceMemDump(instr,15);
+      return -1;
+    }
+
+
+    return 0;
+  } else if (info->cpu_mode == PROTECTED) {
+
     int index = 0;
     int ret;
     char instr[15];
@@ -662,9 +766,28 @@ int handle_cr3_read(struct guest_info * info) {
     }
     
     while (is_prefix_byte(instr[index])) {
-      index++;
+      switch(instr[index]) {
+      case PREFIX_CS_OVERRIDE:
+      case PREFIX_SS_OVERRIDE:
+      case PREFIX_DS_OVERRIDE:
+      case PREFIX_ES_OVERRIDE:
+      case PREFIX_FS_OVERRIDE:
+      case PREFIX_GS_OVERRIDE:
+	PrintDebug("Segment Override!!\n");
+	return -1;
+	break;
+      default:
+	break;
+      }
+      index++; 
     }
 
+    /*
+      while (is_prefix_byte(instr[index])) {
+      index++;
+      }
+    */
+
     if ((instr[index] == cr_access_byte) && 
 	(instr[index + 1] == mov_from_cr_byte)) {
       addr_t first_operand;
@@ -693,11 +816,12 @@ int handle_cr3_read(struct guest_info * info) {
       info->rip += index;
     } else {
       PrintDebug("Unknown Instruction\n");
-      SerialMemDump(instr,15);
+      PrintTraceMemDump(instr,15);
       return -1;
     }
   } else {
-    PrintDebug("Invalid operating Mode (0x%x)\n", info->cpu_mode);
+    PrintDebug("Invalid operating Mode (0x%x), control registers follow\n", info->cpu_mode);
+    PrintV3CtrlRegs(info);
     return -1;
   }