diff --git a/qemu/target-i386/translate.c b/qemu/target-i386/translate.c
index 0efdcce0..349c05c5 100644
--- a/qemu/target-i386/translate.c
+++ b/qemu/target-i386/translate.c
@@ -2664,6 +2664,24 @@ static void gen_enter(DisasContext *s, int esp_addend, int level)
     gen_op_mov_reg_v(tcg_ctx, a_ot, R_ESP, *cpu_T[1]);
 }
 
+static void gen_leave(DisasContext *s)
+{
+    TCGMemOp d_ot = mo_pushpop(s, s->dflag);
+    TCGMemOp a_ot = mo_stacksize(s);
+    TCGContext *tcg_ctx = s->uc->tcg_ctx;
+    TCGv cpu_A0 = *(TCGv *)tcg_ctx->cpu_A0;
+    TCGv **cpu_T = (TCGv **)tcg_ctx->cpu_T;
+    TCGv **cpu_regs = (TCGv **)tcg_ctx->cpu_regs;
+
+    gen_lea_v_seg(s, a_ot, *cpu_regs[R_EBP], R_SS, -1);
+    gen_op_ld_v(s, d_ot, *cpu_T[0], cpu_A0);
+
+    tcg_gen_addi_tl(tcg_ctx, *cpu_T[1], *cpu_regs[R_EBP], 1 << d_ot);
+
+    gen_op_mov_reg_v(tcg_ctx, d_ot, R_EBP, *cpu_T[0]);
+    gen_op_mov_reg_v(tcg_ctx, a_ot, R_ESP, *cpu_T[1]);
+}
+
 static void gen_exception(DisasContext *s, int trapno, target_ulong cur_eip)
 {
     TCGContext *tcg_ctx = s->uc->tcg_ctx;
@@ -5736,20 +5754,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
         }
         break;
     case 0xc9: /* leave */
-        /* XXX: exception not precise (ESP is updated before potential exception) */
-        if (CODE64(s)) {
-            gen_op_mov_v_reg(tcg_ctx, MO_64, *cpu_T[0], R_EBP);
-            gen_op_mov_reg_v(tcg_ctx, MO_64, R_ESP, *cpu_T[0]);
-        } else if (s->ss32) {
-            gen_op_mov_v_reg(tcg_ctx, MO_32, *cpu_T[0], R_EBP);
-            gen_op_mov_reg_v(tcg_ctx, MO_32, R_ESP, *cpu_T[0]);
-        } else {
-            gen_op_mov_v_reg(tcg_ctx, MO_16, *cpu_T[0], R_EBP);
-            gen_op_mov_reg_v(tcg_ctx, MO_16, R_ESP, *cpu_T[0]);
-        }
-        ot = gen_pop_T0(s);
-        gen_op_mov_reg_v(tcg_ctx, ot, R_EBP, *cpu_T[0]);
-        gen_pop_update(s, ot);
+        gen_leave(s);
         break;
     case 0x06: /* push es */
     case 0x0e: /* push cs */