The Thumb/ARM state for the TB being translated should come from the TB flags, not the CPUState.
Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> --- target-arm/translate.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/target-arm/translate.c b/target-arm/translate.c index 10419bf..723961a 100644 --- a/target-arm/translate.c +++ b/target-arm/translate.c @@ -9074,7 +9074,7 @@ static inline void gen_intermediate_code_internal(CPUState *env, dc->pc = pc_start; dc->singlestep_enabled = env->singlestep_enabled; dc->condjmp = 0; - dc->thumb = env->thumb; + dc->thumb = tb->flags & 1; dc->condexec_mask = (env->condexec_bits & 0xf) << 1; dc->condexec_cond = env->condexec_bits >> 4; #if !defined(CONFIG_USER_ONLY) @@ -9161,7 +9161,7 @@ static inline void gen_intermediate_code_internal(CPUState *env, if (num_insns + 1 == max_insns && (tb->cflags & CF_LAST_IO)) gen_io_start(); - if (env->thumb) { + if (dc->thumb) { disas_thumb_insn(env, dc); if (dc->condexec_mask) { dc->condexec_cond = (dc->condexec_cond & 0xe) @@ -9275,7 +9275,7 @@ done_generating: if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) { qemu_log("----------------\n"); qemu_log("IN: %s\n", lookup_symbol(pc_start)); - log_target_disas(pc_start, dc->pc - pc_start, env->thumb); + log_target_disas(pc_start, dc->pc - pc_start, dc->thumb); qemu_log("\n"); } #endif -- 1.6.3.3