fix(relinker): report processor 0 from RDTSCP under --to-rosetta

[Kernel-Hunter]

What

Under Rosetta, RDTSCP loads ECX with Rosetta's constant TSC_AUX, 0xAAAAAAAB, which is not a processor index. --to-rosetta already lowers RDPID to processor 0 for this reason, and docs/dev/debt/relinker.md lists RDTSCP's ECX as not converted. So the same program could read processor 0 through RDPID and 0xAAAAAAAB through RDTSCP.

With --to-rosetta, RDTSCP (0F 01 F9, no 66/F2/F3 prefix) now goes through an optional out-of-line stub, the same mechanism RDPID uses. The stub runs the original RDTSCP, so EDX:EAX and the instruction's ordering stay the same, then does mov ecx, 0 (B9 00 00 00 00). That clears all of RCX and leaves the flags alone. As with RDPID, a site that has no movable instruction after it for the jump is kept, and a kept RDTSCP still reports Rosetta's value. The Intel target and a plain relink do not change.

Changes:

• DecodedInstruction::IsRdtscp, the RDTSCP table entry, and the matcher cases in _matchRosetta, _emitOutOfLine and MatchSequence, which marks a sequence that starts with RDTSCP as optional, as it does for RDPID.
• Amd64OnlyConverterTests: matcher cases (Rosetta stub bytes, optional, not converted for Intel, SWAPGS 0F 01 F8 and 66 0F 01 F9 left alone), plus rdtscpExecution. That test runs the stub on x86-64 Linux and macOS hosts and checks that RCX is 0, the counter is not 0 and CF is preserved. On other hosts it is empty.
• The --to-rosetta entries in docs/dev/debt/relinker.md and docs/user/USAGE.md.

Tested

Apple M5 (MacBook Air), macOS 27.0.1 (26A434), Apple clang 21.0.0, CMake 4.4.4, Ninja 1.13.2.

Rosetta's value, from a standalone x86-64 program built with clang -arch x86_64 and run under Rosetta: RDTSCP returns ECX = 0xaaaaaaab. RDPID ends in SIGILL, which is why it is already lowered.

Relinker-only build, native arm64 (cmake -S . -B build-relinker -G Ninja -DCMAKE_BUILD_TYPE=Release -DANYPS5_RELINKER_ONLY=ON -DBUILD_TESTING=ON):

• ctest --test-dir build-relinker -j8 --timeout 30: 163 of 163 pass.
• Without the source change, the new amd64_only_converter cases fail with RDTSCP was not lowered through an optional stub.

Relinker-only build as x86-64 under Rosetta (same configure plus -DCMAKE_OSX_ARCHITECTURES=x86_64, Python 3 run as x86-64), so that rdtscpExecution really runs the stub:

• amd64_only_converter, to_rosetta and macos_output pass.
• Without the source change, the execution case alone fails with RDTSCP stub was not produced.
• 159 of 163 pass overall. The other 4 (pr_overlap_encoding, stubgen_stdout_newlines, release_package, linux_fixed_base) also fail on main in this setup, because the only x86-64 Python here is the system 3.9, which lacks zip(strict=) and write_text(newline=).

End to end under Rosetta: a byte-built PS5-style ELF (a copy of the macos/import_fixture.py layout) runs rdtscp, then exit(ecx != 0). I relinked it with --macos --skip-sce-module and ran it with two small x86-64 stub dylibs standing in for libc.prx and libkernel.prx. Exit code 1 with main's relinker, both with and without --to-rosetta. Exit code 0 with this branch and --to-rosetta.

python3 tools/check_conventions.py --base origin/main and git diff --check pass. I did not build or run anything on Linux or Windows; the execution test is compiled for x86-64 Linux too, so the Linux CI job runs it. No title was tested.

tools/pr_overlap.py lists text overlap only, not the same function: #5784 (ANDN) touches the same _matchRosetta lines and the same line in relinker.md and USAGE.md, and #5683 and #5762 add calls at the same place in the converter test's main. Whichever merges second needs a small rebase.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes, written with AI assistance. Tested as described above.

[github-actions]

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request	Conflicting files (lines on main)	Same exports	Same new files
PR 7173	core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp L270
PR 7531	core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp L270

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 2780	core/relinker/codegen/include/codegen/x86/Amd64OnlySubstitutionTable.hpp core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
PR 3998	docs/user/USAGE.md
PR 4891	docs/user/USAGE.md
PR 5021	docs/dev/debt/relinker.md docs/user/USAGE.md
PR 5925	docs/user/USAGE.md
PR 6314	docs/user/USAGE.md
PR 6354	docs/dev/debt/relinker.md
PR 6788	docs/user/USAGE.md
PR 6977	docs/dev/debt/relinker.md

[adriadam10]

Checked the RDTSCP decoder (prefix/REX handling, 0F 01 F8 SWAPGS and 66-prefixed forms are left alone), the stub order (original RDTSCP, then mov ecx, 0, which keeps the flags) and the optional-site handling against RDPID. amd64_only_converter, relinker_conversion, relinker_executables and to_rosetta pass on the PR merged onto main, including rdtscpExecution on x86-64 Linux (RCX = 0, counter non-zero, CF preserved). Rosetta-hardware behaviour rests on your M5 run. Merging.

[Kernel-Hunter]

Thanks for checking it. Rebased onto main again: the RDTSCP sentence in docs/dev/debt/relinker.md conflicted with the new macOS 26.4 measurements, so I kept those and changed only the RDPID/RDTSCP part. Relinker tests pass locally (178/178) and the conventions check is clean.