[Qemu-devel] m68k: More bug fixes for translation code

[John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>]

Hi Laurent!

As promised, here are the fixes for the two recently discovered
bugs in the m68k translation code.

The first patch fixes the opcode mask for the fbcc instruction which
is currently incorrect as it masks the 6th bit as constant (0xffc0).
However, according to the ColdFire reference manual, this bit is
used to determine the size of the displacement for the jump, either
16 or 32 bits:

> http://www.nxp.com/files/dsp/doc/ref_manual/CFPRM.pdf (p. 229)

Looking at DISAS_INSN(fbcc), the emulated instruction actually tests
for the 6th bit and sets the offset accordingly. However, since the
current opcode mask ignores this bit, long jumps can never work. In
fact, what we actually see is an illegal instruction: 0xf2e0.

Changing the opcode mask to 0xff80 makes the 6th bit variable and
allows long jumps to work as expected.

The second patch addresses a problem with the thread safety of
register_m68k_insns(). It turns out, that the opcode table is
rebuild for every thread that is started which means that in
a multithreaded environment, one thread can destroy the opcode
table of a concurrent thread which makes this thread crash
with an illegal instruction.

This patch changes register_m68k_insns() such that it returns
without doing anything in case the opcode table has already been
built and re-registering the instructions is therefore not necessary
but rather harmful.

Credits go to Michael Karcher for helping to debug these issues!

Cheers,
Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer - glaubitz@debian.org
`. `'   Freie Universitaet Berlin - glaubitz@physik.fu-berlin.de
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913