[Kernel-Hunter]

What

XSAVEOPT raises an illegal instruction under Rosetta. The PS5's Zen 2 has it, so code built for the console can use it without a CPUID check. With --to-rosetta it is now rewritten to XSAVE in place: 0F AE /6 with a memory operand becomes 0F AE /4, keeping the prefixes, REX and operand, the same way RDSEED becomes RDRAND.

XSAVEOPT differs from XSAVE only in the init and modified optimizations (Intel SDM volume 1, chapter 13). They let it skip writing state that is in its initial configuration or unchanged since the last XRSTOR from the same area. XSAVE writes the same XSTATE_BV and the full state, so XRSTOR restores the same registers from either area.

Not taken: CLWB (66 0F AE /6, already a NOP), MFENCE, UMONITOR, UMWAIT, XSAVE, XRSTOR, CLFLUSH. The Intel target and a plain relink are unchanged. XSAVEC also faults under Rosetta but is not converted, because it writes the compacted format. The debt entry says so.

Changes:

• DecodedInstruction::IsXsaveopt, the XSAVEOPT table entry, and the in-place case in _matchRosetta.
• Amd64OnlyConverterTests: rewrite checks for the plain, REX.W, RSP-relative, r12-based, RIP-relative and FS-relative forms; the neighbouring 0F AE encodings are not taken; not converted for Intel. New xsaveoptExecution runs the rewritten XSAVEOPT64, clears YMM3, runs XRSTOR and checks YMM3, XSTATE_BV and the standard-format offsets. It runs on x86-64 Linux and macOS hosts and is empty elsewhere.
• test_to_rosetta.py now includes XSAVEOPT in the relinked fixture.
• docs/user/USAGE.md (--to-rosetta row) and a new entry in docs/dev/debt/relinker.md.

Tested

Apple M5, macOS 27.0.1 (26A434), Apple clang, relinker-only Release build.

Under Rosetta, from a standalone clang -arch x86_64 program (sysctl.proc_translated = 1) that runs the bytes from executable memory:

48 0F AE 37 (XSAVEOPT64)     signal 4 (Illegal instruction: 4)
48 0F AE 27 (XSAVE64)        executed

Same host: XSAVEC also raises SIGILL. XSAVE64 with RFBM 7 followed by XRSTOR64 restores YMM3, XSTATE_BV reads 7, and the AVX high half is at offset 576. XGETBV reads XCR0 = 7 and CPUID (0xD, 0) gives 832 bytes, but CPUID leaf 1 reports neither XSAVE nor OSXSAVE, and leaf (0xD, 1) reports neither XSAVEOPT nor XSAVEC.

• Native arm64 build: ctest, 207/207 pass.
• x86-64 build under Rosetta (-DCMAKE_OSX_ARCHITECTURES=x86_64), where xsaveoptExecution actually runs: 207/207 pass, including amd64_only_converter and to_rosetta.
• With the rewrite disabled, amd64_only_converter fails with XSAVEOPT was not rewritten to XSAVE.
• python3 tools/check_conventions.py --base origin/main and git diff --check pass.

Not tested on Linux or Windows. The execution test is also built for x86-64 Linux, so the Linux CI job runs it natively. No title was tested, and I don't know of one that uses XSAVEOPT.

No open PR or issue covers XSAVEOPT or XSAVEC. This branch is rebased on main after #6111.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Fixes: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes. The tests above were run on the hardware listed.

[github-actions]

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 5021	docs/dev/debt/relinker.md docs/user/USAGE.md
PR 5925	docs/user/USAGE.md
PR 6171	docs/user/USAGE.md
PR 6924	docs/user/USAGE.md
PR 7173	core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp docs/dev/debt/relinker.md
PR 7642	docs/user/USAGE.md
PR 7942	docs/user/USAGE.md
PR 8042	core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
PR 8076	docs/dev/debt/relinker.md
PR 8236	core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
PR 9184	core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
PR 9228	docs/dev/debt/relinker.md
PR 9401	docs/user/USAGE.md
PR 9408	docs/dev/debt/relinker.md docs/user/USAGE.md
PR 9508	docs/user/USAGE.md
PR 10193	docs/user/USAGE.md

[blawesom]

Rebase handoff — rebased onto current main (a9cfea22f, clean, authorship unchanged).

Verified on Linux (CachyOS, kernel 7.2.9, GCC 16.2.1, Ninja, Release, BUILD_TESTING=ON, AMD RX 9070 XT / RADV): builds; 1717/1720 — green apart from the three known current-main failures on this stack (#7784 guest-memory, tessellation pending Mesa 26.2.6, and image_array_window_past_layer_limit — newly-arrived red flagged on #6772), none from this PR; conventions pass. The Rosetta XSAVE rewrite itself is macOS-gated, not exercised here.

To pick it up:

git fetch https://github.com/blawesom/AnyPS5 rebase/7918
git checkout <your branch>
git merge --ff-only FETCH_HEAD

Head is baafb462a.

[adriadam10]

Checked the XSAVEOPT decoder (66 = CLWB, F3 = CLRSSBSY, F2 and the register form are left alone), the ModRM rewrite /6 to /4 with prefixes, REX and operand kept, the converter tests (plain, REX.W, RSP, r12, RIP-relative, FS, neighbouring 0F AE forms, Intel unchanged), xsaveoptExecution on x86-64 Linux, and the USAGE and debt entries. Rebased onto main (conflicts in Amd64OnlyConverterTests.cpp and docs/dev/debt/relinker.md, both sides kept); the relinker tests pass on the rebased branch; merged.