segment validation fix in lret/iret

diff --git a/target-i386/helper.c b/target-i386/helper.c
index 5c1d6cd80df3b42f3449dd7a87b889dd65931173..0c5e362c7346f17c9d56b737fd630e95a8d74c1a 100644 (file)
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1584,7 +1584,7 @@ void load_seg(int seg_reg, int selector)
             
             if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) {
                 /* if not conforming code, test rights */
-                if (dpl < cpl || dpl < rpl)
+                if (dpl < cpl || dpl < rpl) 
                     raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
             }
         }
@@ -2152,10 +2152,10 @@ static inline void helper_ret_protected(int shift, int is_iret, int addend)
             sp_mask = get_sp_mask(ss_e2);
 
         /* validate data segments */
-        validate_seg(R_ES, cpl);
-        validate_seg(R_DS, cpl);
-        validate_seg(R_FS, cpl);
-        validate_seg(R_GS, cpl);
+        validate_seg(R_ES, rpl);
+        validate_seg(R_DS, rpl);
+        validate_seg(R_FS, rpl);
+        validate_seg(R_GS, rpl);
 
         sp += addend;
     }