diff --git a/qemu/qom/cpu.c b/qemu/qom/cpu.c
index a78df8b8..fa7aa78a 100644
--- a/qemu/qom/cpu.c
+++ b/qemu/qom/cpu.c
@@ -76,14 +76,14 @@ out:
 
 void *cpu_alloc_env(CPUState *cpu)
 {
-    CPUClass *cc = CPU_GET_CLASS(cpu);
+    CPUClass *cc = CPU_GET_CLASS(cpu->uc, cpu);
 
     return cc->alloc_env ? cc->alloc_env(cpu) : NULL;
 }
 
 void cpu_get_env(CPUState *cpu, void *env)
 {
-    CPUClass *cc = CPU_GET_CLASS(cpu);
+    CPUClass *cc = CPU_GET_CLASS(cpu->uc, cpu);
 
     if (cc->get_env) {
         cc->get_env(cpu, env);
@@ -92,7 +92,7 @@ void cpu_get_env(CPUState *cpu, void *env)
 
 void cpu_set_env(CPUState *cpu, void *env)
 {
-    CPUClass *cc = CPU_GET_CLASS(cpu);
+    CPUClass *cc = CPU_GET_CLASS(cpu->uc, cpu);
 
     if (cc->set_env) {
         cc->set_env(cpu, env);
@@ -101,7 +101,7 @@ void cpu_set_env(CPUState *cpu, void *env)
 
 void cpu_free_env(CPUState *cpu, void *env)
 {
-    CPUClass *cc = CPU_GET_CLASS(cpu);
+    CPUClass *cc = CPU_GET_CLASS(cpu->uc, cpu);
 
     if (cc->free_env) {
         cc->free_env(cpu, env);
diff --git a/qemu/target/i386/translate.c b/qemu/target/i386/translate.c
index 74da7f71..2c6a9744 100644
--- a/qemu/target/i386/translate.c
+++ b/qemu/target/i386/translate.c
@@ -4646,6 +4646,7 @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b,
             if (sse_fn_eppi == SSE_SPECIAL) {
                 ot = mo_64_32(s->dflag);
                 rm = (modrm & 7) | REX_B(s);
+                s->rip_offset = 1;
                 if (mod != 3)
                     gen_lea_modrm(env, s, modrm);
                 reg = ((modrm >> 3) & 7) | rex_r;