I am running Qemu (plain, no kvm, etc) on an AMD 10h machine that provides popcnt instruction. Qemu advertises availability of pocnt to a guest as well. What I see in the guest that popcnt 0x20(%r12),%r8 instruction actually placed its result into %rax. With %rdi and %rax operands the instruction worked fine though.
-- Andriy Gapon