x86: 0.998 semantic: 0.995 architecture: 0.914 graphic: 0.860 register: 0.829 device: 0.736 assembly: 0.728 mistranslation: 0.574 i386: 0.505 vnc: 0.420 boot: 0.411 risc-v: 0.390 ppc: 0.382 debug: 0.352 permissions: 0.340 kernel: 0.295 socket: 0.263 arm: 0.205 network: 0.171 PID: 0.153 performance: 0.140 files: 0.125 peripherals: 0.120 VMM: 0.095 KVM: 0.083 TCG: 0.075 virtual: 0.058 hypervisor: 0.028 user-level: 0.018 -------------------- x86: 1.000 i386: 0.987 semantic: 0.982 assembly: 0.973 debug: 0.546 register: 0.253 user-level: 0.131 kernel: 0.057 virtual: 0.052 files: 0.045 performance: 0.027 TCG: 0.022 hypervisor: 0.021 architecture: 0.014 PID: 0.014 network: 0.013 peripherals: 0.010 device: 0.009 VMM: 0.004 risc-v: 0.004 permissions: 0.004 socket: 0.003 boot: 0.003 graphic: 0.002 KVM: 0.002 ppc: 0.002 vnc: 0.001 mistranslation: 0.001 arm: 0.000 x86 BEXTR semantic bug Description of problem: The result of instruction BEXTR is different with from the CPU. The value of destination register is different. I think QEMU does not consider the operand size limit. Steps to reproduce: 1. Compile this code ``` void main() { asm("mov rax, 0x17b3693f77fb6e9"); asm("mov rbx, 0x8f635a775ad3b9b4"); asm("mov rcx, 0xb717b75da9983018"); asm("bextr eax, ebx, ecx"); } ``` 2. Execute and compare the result with the CPU. - CPU - RAX = 0x5a - QEMU - RAX = 0x635a775a Additional information: This bug is discovered by research conducted by KAIST SoftSec.