add results

6 files changed, 259 insertions, 0 deletions

diff --git a/results/classifier/009/semantic/gitlab_semantic_addsubps b/results/classifier/009/semantic/gitlab_semantic_addsubps
new file mode 100644
index 000000000..d0059f893
--- /dev/null
+++ b/results/classifier/009/semantic/gitlab_semantic_addsubps
@@ -0,0 +1,38 @@
+semantic: 0.974
+device: 0.758
+other: 0.732
+graphic: 0.700
+debug: 0.650
+performance: 0.552
+vnc: 0.544
+boot: 0.465
+permissions: 0.443
+socket: 0.426
+network: 0.393
+PID: 0.358
+files: 0.280
+KVM: 0.192
+
+x86 SSE/SSE2/SSE3 instruction semantic bugs with NaN
+
+Description of problem
+The result of SSE/SSE2/SSE3 instructions with NaN is different from the CPU. From Intel manual Volume 1 Appendix D.4.2.2, they defined the behavior of such instructions with NaN. But I think QEMU did not implement this semantic exactly because the byte result is different.
+
+Steps to reproduce
+
+Compile this code
+
+void main() {
+    asm("mov rax, 0x000000007fffffff; push rax; mov rax, 0x00000000ffffffff; push rax; movdqu XMM1, [rsp];");
+    asm("mov rax, 0x2e711de7aa46af1a; push rax; mov rax, 0x7fffffff7fffffff; push rax; movdqu XMM2, [rsp];");
+    asm("addsubps xmm1, xmm2");
+}
+
+Execute and compare the result with the CPU. This problem happens with other SSE/SSE2/SSE3 instructions specified in the manual, Volume 1 Appendix D.4.2.2.
+
+CPU xmm1[3] = 0xffffffff
+
+QEMU xmm1[3] = 0x7fffffff
+
+Additional information
+This bug is discovered by research conducted by KAIST SoftSec.
diff --git a/results/classifier/009/semantic/gitlab_semantic_adox b/results/classifier/009/semantic/gitlab_semantic_adox
new file mode 100644
index 000000000..abcd950e3
--- /dev/null
+++ b/results/classifier/009/semantic/gitlab_semantic_adox
@@ -0,0 +1,51 @@
+semantic: 0.990
+graphic: 0.782
+device: 0.776
+debug: 0.706
+vnc: 0.663
+boot: 0.599
+socket: 0.556
+permissions: 0.500
+performance: 0.460
+network: 0.426
+files: 0.374
+PID: 0.343
+other: 0.286
+KVM: 0.240
+
+x86 ADOX and ADCX semantic bug
+Description of problem
+The result of instruction ADOX and ADCX are different from the CPU. The value of one of EFLAGS is different.
+
+Steps to reproduce
+
+Compile this code
+
+
+void main() {
+    asm("push 512; popfq;");
+    asm("mov rax, 0xffffffff84fdbf24");
+    asm("mov rbx, 0xb197d26043bec15d");
+    asm("adox eax, ebx");
+}
+
+
+
+Execute and compare the result with the CPU. This problem happens with ADCX, too (with CF).
+
+CPU
+
+OF = 0
+
+
+QEMU
+
+OF = 1
+
+
+
+
+
+
+Additional information
+This bug is discovered by research conducted by KAIST SoftSec.
diff --git a/results/classifier/009/semantic/gitlab_semantic_bextr b/results/classifier/009/semantic/gitlab_semantic_bextr
new file mode 100644
index 000000000..669cff515
--- /dev/null
+++ b/results/classifier/009/semantic/gitlab_semantic_bextr
@@ -0,0 +1,40 @@
+semantic: 0.993
+graphic: 0.790
+device: 0.717
+debug: 0.603
+boot: 0.516
+vnc: 0.471
+socket: 0.397
+PID: 0.234
+performance: 0.233
+network: 0.219
+permissions: 0.188
+other: 0.099
+files: 0.099
+KVM: 0.091
+
+x86 BEXTR semantic bug
+Description of problem
+The result of instruction BEXTR is different with from the CPU. The value of destination register is different. I think QEMU does not consider the operand size limit.
+
+Steps to reproduce
+
+Compile this code
+
+void main() {
+    asm("mov rax, 0x17b3693f77fb6e9");
+    asm("mov rbx, 0x8f635a775ad3b9b4");
+    asm("mov rcx, 0xb717b75da9983018");
+    asm("bextr eax, ebx, ecx");
+}
+
+Execute and compare the result with the CPU.
+
+CPU
+RAX = 0x5a
+
+QEMU
+RAX = 0x635a775a
+
+Additional information
+This bug is discovered by research conducted by KAIST SoftSec.
diff --git a/results/classifier/009/semantic/gitlab_semantic_blsi b/results/classifier/009/semantic/gitlab_semantic_blsi
new file mode 100644
index 000000000..3e01589a9
--- /dev/null
+++ b/results/classifier/009/semantic/gitlab_semantic_blsi
@@ -0,0 +1,35 @@
+semantic: 0.983
+graphic: 0.873
+device: 0.790
+socket: 0.764
+vnc: 0.756
+boot: 0.678
+network: 0.672
+performance: 0.656
+files: 0.633
+permissions: 0.619
+other: 0.609
+debug: 0.525
+PID: 0.488
+KVM: 0.412
+
+x86 BLSI and BLSR semantic bug
+Description of problem
+The result of instruction BLSI and BLSR is different from the CPU. The value of CF is different.
+
+Steps to reproduce
+
+Compile this code
+
+
+void main() {
+    asm("blsi rax, rbx");
+}
+
+
+
+Execute and compare the result with the CPU. The value of CF is exactly the opposite. This problem happens with BLSR, too.
+
+
+Additional information
+This bug is discovered by research conducted by KAIST SoftSec.
diff --git a/results/classifier/009/semantic/gitlab_semantic_blsmsk b/results/classifier/009/semantic/gitlab_semantic_blsmsk
new file mode 100644
index 000000000..45bb634d4
--- /dev/null
+++ b/results/classifier/009/semantic/gitlab_semantic_blsmsk
@@ -0,0 +1,42 @@
+semantic: 0.987
+device: 0.743
+graphic: 0.735
+vnc: 0.612
+socket: 0.607
+boot: 0.585
+debug: 0.428
+permissions: 0.370
+network: 0.366
+files: 0.340
+PID: 0.289
+other: 0.269
+performance: 0.268
+KVM: 0.163
+
+x86 BLSMSK semantic bug
+Description of problem
+The result of instruction BLSMSK is different with from the CPU. The value of CF is different.
+
+Steps to reproduce
+
+Compile this code
+
+void main() {
+    asm("mov rax, 0x65b2e276ad27c67");
+    asm("mov rbx, 0x62f34955226b2b5d");
+    asm("blsmsk eax, ebx");
+}
+
+Execute and compare the result with the CPU.
+
+CPU
+
+CF = 0
+
+
+QEMU
+
+CF = 1
+
+Additional information
+This bug is discovered by research conducted by KAIST SoftSec.
diff --git a/results/classifier/009/semantic/gitlab_semantic_bzhi b/results/classifier/009/semantic/gitlab_semantic_bzhi
new file mode 100644
index 000000000..253ab4184
--- /dev/null
+++ b/results/classifier/009/semantic/gitlab_semantic_bzhi
@@ -0,0 +1,53 @@
+semantic: 0.920
+graphic: 0.652
+device: 0.589
+vnc: 0.287
+debug: 0.256
+boot: 0.220
+network: 0.203
+socket: 0.198
+performance: 0.165
+PID: 0.130
+permissions: 0.069
+other: 0.064
+KVM: 0.064
+files: 0.051
+
+x86 BZHI semantic bug
+Description of problem
+The result of instruction BZHI is different from the CPU. The value of destination register and SF of EFLAGS are different.
+
+Steps to reproduce
+
+Compile this code
+
+
+void main() {
+    asm("mov rax, 0xb1aa9da2fe33fe3");
+    asm("mov rbx, 0x80000000ffffffff");
+    asm("mov rcx, 0xf3fce8829b99a5c6");
+    asm("bzhi rax, rbx, rcx");
+}
+
+
+
+Execute and compare the result with the CPU.
+
+CPU
+
+RAX = 0x0x80000000ffffffff
+SF = 1
+
+
+QEMU
+
+RAX = 0xffffffff
+SF = 0
+
+
+
+
+
+
+Additional information
+This bug is discovered by research conducted by KAIST SoftSec.