In vm86 mode, we use the same helper as real-mode, but with an extra check for IOPL. All non-exceptional paths set EFLAGS.
Signed-off-by: Richard Henderson <richard.hender...@linaro.org> Reviewed-by: Paolo Bonzini <pbonz...@redhat.com> Message-Id: <20210514151342.384376-4-richard.hender...@linaro.org> --- target/i386/tcg/translate.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index 61b30117a3..0a15662949 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -6577,22 +6577,18 @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu) goto do_lret; case 0xcf: /* iret */ gen_svm_check_intercept(s, pc_start, SVM_EXIT_IRET); - if (!s->pe) { - /* real mode */ - gen_helper_iret_real(cpu_env, tcg_const_i32(dflag - 1)); - set_cc_op(s, CC_OP_EFLAGS); - } else if (s->vm86) { - if (s->iopl != 3) { + if (!s->pe || s->vm86) { + /* real mode or vm86 mode */ + if (s->vm86 && s->iopl != 3) { gen_exception_gpf(s); - } else { - gen_helper_iret_real(cpu_env, tcg_const_i32(dflag - 1)); - set_cc_op(s, CC_OP_EFLAGS); + break; } + gen_helper_iret_real(cpu_env, tcg_const_i32(dflag - 1)); } else { gen_helper_iret_protected(cpu_env, tcg_const_i32(dflag - 1), tcg_const_i32(s->pc - s->cs_base)); - set_cc_op(s, CC_OP_EFLAGS); } + set_cc_op(s, CC_OP_EFLAGS); gen_eob(s); break; case 0xe8: /* call im */ -- 2.25.1