From 0e76e79962a0e538d52681a58451dc051baeffda Mon Sep 17 00:00:00 2001
From: TomW <TomW@localhost>
Date: Mon, 10 Aug 2015 17:50:15 +0100
Subject: [PATCH] Fixed CPL in IRET and RETF instructions when returning to
 conforming code segment.

---
 src/x86seg.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/x86seg.c b/src/x86seg.c
index 235ba05..c723393 100644
--- a/src/x86seg.c
+++ b/src/x86seg.c
@@ -1400,6 +1400,7 @@ void pmoderetf(int is32, uint16_t off)
                    segdat[2] = (segdat[2] & ~(3 << (5+8))) | ((seg & 3) << (5+8));
                 CS = seg;
                 do_seg_load(&_cs, segdat);
+                _cs.access = (_cs.access & ~(3 << 5)) | ((CS & 3) << 5);
                 if (CPL==3 && oldcpl!=3) flushmmucache_cr3();
                 use32=(segdat[3]&0x40)?0x300:0;
                 
@@ -2191,6 +2192,7 @@ void pmodeiret(int is32)
 //                pclog("Same level\n");
                 CS=seg;
                 do_seg_load(&_cs, segdat);
+                _cs.access = (_cs.access & ~(3 << 5)) | ((CS & 3) << 5);
                 if (CPL==3 && oldcpl!=3) flushmmucache_cr3();
                 use32=(segdat[3]&0x40)?0x300:0;
 
@@ -2305,6 +2307,7 @@ void pmodeiret(int is32)
 
                 CS=seg;
                 do_seg_load(&_cs, segdat);
+                _cs.access = (_cs.access & ~(3 << 5)) | ((CS & 3) << 5);
                 if (CPL==3 && oldcpl!=3) flushmmucache_cr3();
                 use32=(segdat[3]&0x40)?0x300:0;