Commit fe12f7c8a8 for qemu.org

commit fe12f7c8a88c097134c9a885270154a52582f887
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Wed Jan 7 05:42:38 2026 +0100

    target/i386/tcg: do not leave non-arithmetic flags in CC_SRC after PUSHF

    The value that is pushed by PUSHF is the full EFLAGS, while CC_OP_EFLAGS
    only wants arithmetic flags in CC_SRC.  To avoid this, follow what other
    helpers do and set CC_SRC/CC_OP directly in helper_read_eflags.  This
    is basically free and fixes an issue booting Windows 3.11.

    Reported-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
    Fixes: e661e2d7a37 ("target/i386/tcg: update cc_op after PUSHF", 2025-12-27)
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/target/i386/tcg/cc_helper.c b/target/i386/tcg/cc_helper.c
index 91e492196a..6ddd64fcb0 100644
--- a/target/i386/tcg/cc_helper.c
+++ b/target/i386/tcg/cc_helper.c
@@ -414,7 +414,9 @@ target_ulong helper_read_eflags(CPUX86State *env)
 {
     uint32_t eflags;

-    eflags = cpu_cc_compute_all(env);
+    CC_SRC = eflags = cpu_cc_compute_all(env);
+    CC_OP = CC_OP_EFLAGS;
+
     eflags |= (env->df & DF_MASK);
     eflags |= env->eflags & ~(VM_MASK | RF_MASK);
     return eflags;
diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
index 0fde3d669d..e55b65176f 100644
--- a/target/i386/tcg/emit.c.inc
+++ b/target/i386/tcg/emit.c.inc
@@ -3253,8 +3253,7 @@ static void gen_PUSHF(DisasContext *s, X86DecodedInsn *decode)
     gen_update_cc_op(s);
     gen_helper_read_eflags(s->T0, tcg_env);
     gen_push_v(s, s->T0);
-    decode->cc_src = s->T0;
-    decode->cc_op = CC_OP_EFLAGS;
+    assume_cc_op(s, CC_OP_EFLAGS);
 }

 static MemOp gen_shift_count(DisasContext *s, X86DecodedInsn *decode,