diff --git a/target/m68k/translate.c b/target/m68k/translate.c index 62a96bedcd..ff3493d8ab 100644 --- a/target/m68k/translate.c +++ b/target/m68k/translate.c @@ -6105,9 +6105,25 @@ static void m68k_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu) disas_m68k_insn(cpu->env_ptr, dc); dc->base.pc_next = dc->pc; - if (dc->base.is_jmp == DISAS_NEXT - && dc->pc - dc->base.pc_first >= TARGET_PAGE_SIZE - 32) { - dc->base.is_jmp = DISAS_TOO_MANY; + if (dc->base.is_jmp == DISAS_NEXT) { + /* Stop translation when the next insn might touch a new page. + * This ensures that prefetch aborts at the right place. + * + * We cannot determine the size of the next insn without + * completely decoding it. However, the maximum insn size + * is 32 bytes, so end if we do not have that much remaining. + * This may produce several small TBs at the end of each page, + * but they will all be linked with goto_tb. + * + * ??? ColdFire maximum is 4 bytes; MC68000's maximum is also + * smaller than MC68020's. + */ + target_ulong start_page_offset + = dc->pc - (dc->base.pc_first & TARGET_PAGE_MASK); + + if (start_page_offset >= TARGET_PAGE_SIZE - 32) { + dc->base.is_jmp = DISAS_TOO_MANY; + } } }