1 files changed, 15 insertions, 3 deletions
diff --git a/src/Ryujinx.Cpu/LightningJit/Arm32/Target/Arm64/InstEmitMemory.cs b/src/Ryujinx.Cpu/LightningJit/Arm32/Target/Arm64/InstEmitMemory.cs
index 6ab4b949..d8caee6e 100644
--- a/src/Ryujinx.Cpu/LightningJit/Arm32/Target/Arm64/InstEmitMemory.cs
+++ b/src/Ryujinx.Cpu/LightningJit/Arm32/Target/Arm64/InstEmitMemory.cs
@@ -1126,11 +1126,23 @@ namespace Ryujinx.Cpu.LightningJit.Arm32.Target.Arm64
             Operand destination64 = new(destination.Kind, OperandType.I64, destination.Value);
             Operand basePointer = new(regAlloc.FixedPageTableRegister, RegisterType.Integer, OperandType.I64);
 
-            if (mmType == MemoryManagerType.HostMapped || mmType == MemoryManagerType.HostMappedUnsafe)
+            // We don't need to mask the address for the safe mode, since it is already naturally limited to 32-bit
+            // and can never reach out of the guest address space.
+
+            if (mmType.IsHostTracked())
             {
-                // We don't need to mask the address for the safe mode, since it is already naturally limited to 32-bit
-                // and can never reach out of the guest address space.
+                int tempRegister = regAlloc.AllocateTempGprRegister();
+
+                Operand pte = new(tempRegister, RegisterType.Integer, OperandType.I64);
+
+                asm.Lsr(pte, guestAddress, new Operand(OperandKind.Constant, OperandType.I32, 12));
+                asm.LdrRr(pte, basePointer, pte, ArmExtensionType.Uxtx, true);
+                asm.Add(destination64, pte, guestAddress);
 
+                regAlloc.FreeTempGprRegister(tempRegister);
+            }
+            else if (mmType.IsHostMapped())
+            {
                 asm.Add(destination64, basePointer, guestAddress);
             }
             else