blob: 944cd8148c525f01f11ae8fdf0a7cb631d953df5 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
semantic: 0.920
instruction: 0.623
boot: 0.220
mistranslation: 0.171
other: 0.064
x86 BZHI semantic bug
Description of problem
The result of instruction BZHI is different from the CPU. The value of destination register and SF of EFLAGS are different.
Steps to reproduce
Compile this code
void main() {
asm("mov rax, 0xb1aa9da2fe33fe3");
asm("mov rbx, 0x80000000ffffffff");
asm("mov rcx, 0xf3fce8829b99a5c6");
asm("bzhi rax, rbx, rcx");
}
Execute and compare the result with the CPU.
CPU
RAX = 0x0x80000000ffffffff
SF = 1
QEMU
RAX = 0xffffffff
SF = 0
Additional information
This bug is discovered by research conducted by KAIST SoftSec.
|