diff options
Diffstat (limited to 'target/i386/tcg/tcg-cpu.c')
| -rw-r--r-- | target/i386/tcg/tcg-cpu.c | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c index 6e881e9e27..1d54164bdf 100644 --- a/target/i386/tcg/tcg-cpu.c +++ b/target/i386/tcg/tcg-cpu.c @@ -68,14 +68,26 @@ static void x86_restore_state_to_opc(CPUState *cs, X86CPU *cpu = X86_CPU(cs); CPUX86State *env = &cpu->env; int cc_op = data[1]; + uint64_t new_pc; if (tb_cflags(tb) & CF_PCREL) { - env->eip = (env->eip & TARGET_PAGE_MASK) | data[0]; - } else if (tb->flags & HF_CS64_MASK) { - env->eip = data[0]; + /* + * data[0] in PC-relative TBs is also a linear address, i.e. an address with + * the CS base added, because it is not guaranteed that EIP bits 12 and higher + * stay the same across the translation block. Add the CS base back before + * replacing the low bits, and subtract it below just like for !CF_PCREL. + */ + uint64_t pc = env->eip + tb->cs_base; + new_pc = (pc & TARGET_PAGE_MASK) | data[0]; } else { - env->eip = (uint32_t)(data[0] - tb->cs_base); + new_pc = data[0]; } + if (tb->flags & HF_CS64_MASK) { + env->eip = new_pc; + } else { + env->eip = (uint32_t)(new_pc - tb->cs_base); + } + if (cc_op != CC_OP_DYNAMIC) { env->cc_op = cc_op; } |