gen_flush_flags() is setting unconditionally cc_op_synced to 1 and s->cc_op to CC_OP_FLAGS, whereas env->cc_op can be set to something else by a previous tcg fragment.
We fix that by not setting cc_op_synced to 1 (except for gen_helper_flush_flags() that updates env->cc_op) FIX: https://github.com/vivier/qemu-m68k/issues/19 Signed-off-by: Laurent Vivier <laur...@vivier.eu> Reviewed-by: Richard Henderson <r...@twiddle.net> --- target/m68k/translate.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/target/m68k/translate.c b/target/m68k/translate.c index 410f56a..0e97900 100644 --- a/target/m68k/translate.c +++ b/target/m68k/translate.c @@ -595,18 +595,19 @@ static void gen_flush_flags(DisasContext *s) case CC_OP_DYNAMIC: gen_helper_flush_flags(cpu_env, QREG_CC_OP); + s->cc_op_synced = 1; break; default: t0 = tcg_const_i32(s->cc_op); gen_helper_flush_flags(cpu_env, t0); tcg_temp_free(t0); + s->cc_op_synced = 1; break; } /* Note that flush_flags also assigned to env->cc_op. */ s->cc_op = CC_OP_FLAGS; - s->cc_op_synced = 1; } static inline TCGv gen_extend(TCGv val, int opsize, int sign) -- 2.7.4