diff --git a/target-i386/helper.c b/target-i386/helper.c
index d08de8a8b4..3d44cc86b6 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1679,7 +1679,7 @@ static inline void helper_ret_protected(int shift, int is_iret, int addend)
                        ss_e2);
         cpu_x86_set_cpl(env, rpl);
         sp = new_esp;
-        /* XXX: change sp_mask according to old segment ? */
+        sp_mask = get_sp_mask(ss_e2);
 
         /* validate data segments */
         validate_seg(R_ES, cpl);