From 570c3297d334c4f4a9070da5a442d2a21ef9e9c9 Mon Sep 17 00:00:00 2001
From: aasishdairel <aasishdairel@gmail.com>
Date: Mon, 19 Oct 2026 23:34:36 +0530
Subject: [PATCH 1/5] fix(relinker): trap only GS memory accesses in Windows
 and macOS output

---
 .../codegen/include/codegen/CodegenTypes.hpp       |  1 +
 .../codegen/src/x86/X64InstructionDecoder.cpp      |  8 ++++++++
 core/relinker/codegen/tests/DecoderLengthTests.cpp | 13 +++++++++++++
 core/relinker/elfpatcher/src/macos/MacOsImage.cpp  |  3 ++-
 .../elfpatcher/src/windows/WindowsTlsBuilder.cpp   |  3 ++-
 .../relinker/relinker/tests/test_macos_gs_traps.py | 14 ++++++++++++++
 .../relinker/tests/test_tls_function_coverage.py   | 13 +++++++++++++
 docs/dev/debt/relinker.md                          |  2 +-
 8 files changed, 54 insertions(+), 3 deletions(-)

diff --git a/core/relinker/codegen/include/codegen/CodegenTypes.hpp b/core/relinker/codegen/include/codegen/CodegenTypes.hpp
index 72bace4267..021f2bf059 100644
--- a/core/relinker/codegen/include/codegen/CodegenTypes.hpp
+++ b/core/relinker/codegen/include/codegen/CodegenTypes.hpp
@@ -68,6 +68,7 @@ struct DecodedInstructionInfo {
     bool AddressSize32;
     std::size_t RipRelativeDispOffset;
     bool HasModRm;
+    bool HasMemoryOperand;
     std::uint8_t ModRmByte;
     bool HasBranchTarget;
     std::int64_t BranchDisp;
diff --git a/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp b/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
index c6cc9de4ac..5c93d00390 100644
--- a/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
+++ b/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
@@ -393,6 +393,8 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
         info.ModRmRegField = (modrm >> ModRmRegShift) & ModRmRegMask;
         const std::uint8_t mod = registerOnly ? ModRmModRegister : (modrm >> ModRmModShift) & ModRmModMask;
         const std::uint8_t rm = modrm & ModRmRmMask;
+        if (mod != ModRmModRegister)
+            info.HasMemoryOperand = true;
         if (mod == ModRmModIndirect && rm == ModRmRmRipRelative) {
             info.HasRipRelativeDisp = true;
             info.RipRelativeDispOffset = modrmPos + 1;
@@ -480,6 +482,8 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
             info.ModRmRegField = reg;
             std::uint8_t mod = (modrm >> ModRmModShift) & ModRmModMask;
             std::uint8_t rm = modrm & ModRmRmMask;
+            if (mod != ModRmModRegister)
+                info.HasMemoryOperand = true;
             if (reg == 2) {
                 if (mod == ModRmModIndirect && rm == ModRmRmRipRelative) {
                     info.FlowKind = ControlFlowKind::Call;
@@ -592,6 +596,10 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
     if (hasModRm && pos < info.Length)
         readModRm(pos, twoByteOpcode && op >= TwoByteMovCrDrMin && op <= TwoByteMovCrDrMax);
 
+    if (!twoByteOpcode && ((op >= 0x6c && op <= 0x6f) || (op >= 0xa0 && op <= 0xa7) ||
+                           (op >= 0xaa && op <= 0xaf) || op == 0xd7))
+        info.HasMemoryOperand = true;
+
     info.FlowKind = ControlFlowKind::Sequential;
     return info;
 }
diff --git a/core/relinker/codegen/tests/DecoderLengthTests.cpp b/core/relinker/codegen/tests/DecoderLengthTests.cpp
index 63bca4bfe0..e7c7340696 100644
--- a/core/relinker/codegen/tests/DecoderLengthTests.cpp
+++ b/core/relinker/codegen/tests/DecoderLengthTests.cpp
@@ -117,6 +117,19 @@ int main() {
         const auto threeDNowInfo = decoder.DecodeInstruction(threeDNow.data(), threeDNow.size());
         require(threeDNowInfo.HasModRm && threeDNowInfo.ModRmByte == 0x0d, "3DNow! ModRM was not reported");
         require(threeDNowInfo.HasRipRelativeDisp && threeDNowInfo.RipRelativeDispOffset == 3, "3DNow! RIP-relative displacement was not reported");
+        for (const auto& testCase : std::vector<std::pair<const char*, bool>>{
+            {"6590", false},
+            {"654889c8", false},
+            {"65488b0c2578030000", true},
+            {"65a4", true},
+            {"650fa2", false},
+            {"ff10", true},
+            {"ffe0", false},
+        }) {
+            const auto bytes = parse(testCase.first);
+            require(decoder.DecodeInstruction(bytes.data(), bytes.size()).HasMemoryOperand == testCase.second,
+                    "Wrong memory operand presence for " + std::string(testCase.first));
+        }
         std::cout << "Decoder length tests passed\n";
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
diff --git a/core/relinker/elfpatcher/src/macos/MacOsImage.cpp b/core/relinker/elfpatcher/src/macos/MacOsImage.cpp
index 91a7665452..6af3a39fb6 100644
--- a/core/relinker/elfpatcher/src/macos/MacOsImage.cpp
+++ b/core/relinker/elfpatcher/src/macos/MacOsImage.cpp
@@ -245,7 +245,8 @@ TlsScan ScanTls(const std::vector<std::uint8_t>& source, const std::vector<Domai
             }
             if (info.SegmentPrefix == 0 || (insidePrevious && info.SegmentPrefix != 0x64)) continue;
             if (info.SegmentPrefix == 0x65) {
-                scan.GsTraps.push_back({rva, info.Length});
+                if (info.HasMemoryOperand)
+                    scan.GsTraps.push_back({rva, info.Length});
                 continue;
             }
             const auto position = info.OpcodeOffset;
diff --git a/core/relinker/elfpatcher/src/windows/WindowsTlsBuilder.cpp b/core/relinker/elfpatcher/src/windows/WindowsTlsBuilder.cpp
index 08576fe5f8..93da3e5270 100644
--- a/core/relinker/elfpatcher/src/windows/WindowsTlsBuilder.cpp
+++ b/core/relinker/elfpatcher/src/windows/WindowsTlsBuilder.cpp
@@ -150,7 +150,8 @@ PeDirectory WindowsTlsBuilder::Build(const std::vector<std::uint8_t>& source, co
             }
 
             if (info.SegmentPrefix == 0x65 && !insidePrevious) {
-                gsTraps.emplace_back(rva, info.Length);
+                if (info.HasMemoryOperand)
+                    gsTraps.emplace_back(rva, info.Length);
                 continue;
             }
             if (info.SegmentPrefix != 0 && !(insidePrevious && info.SegmentPrefix != 0x64)) {
diff --git a/core/relinker/relinker/tests/test_macos_gs_traps.py b/core/relinker/relinker/tests/test_macos_gs_traps.py
index 8b9c21512d..9f67360693 100644
--- a/core/relinker/relinker/tests/test_macos_gs_traps.py
+++ b/core/relinker/relinker/tests/test_macos_gs_traps.py
@@ -17,6 +17,12 @@ FORMS = {
     "gs-short-register-address": bytes.fromhex("65 48 8b 00"),
 }
 
+NON_MEMORY_FORMS = {
+    "gs-nop": bytes.fromhex("65 90"),
+    "gs-register-move": bytes.fromhex("65 48 89 c8"),
+    "gs-cpuid": bytes.fromhex("65 0f a2"),
+}
+
 
 def convert(relinker, directory, name, image):
     source = Path(directory) / f"{name}.elf"
@@ -38,12 +44,20 @@ def check_trapped(name, code, instruction):
         raise SystemExit(f"{name}: the GS access was left in the code")
 
 
+def check_untouched(name, code, instruction):
+    if instruction + b"\xc3" not in code:
+        raise SystemExit(f"{name}: a non-memory GS instruction was replaced")
+
+
 def main():
     relinker = Path(sys.argv[1]).resolve()
     with tempfile.TemporaryDirectory(prefix="anyps5-macos-gs-") as directory:
         for name, instruction in FORMS.items():
             image = make_image("register", "unwind", body=instruction + b"\xc3")
             check_trapped(name, convert(relinker, directory, name, image), instruction)
+        for name, instruction in NON_MEMORY_FORMS.items():
+            image = make_image("register", "unwind", body=instruction + b"\xc3")
+            check_untouched(name, convert(relinker, directory, name, image), instruction)
         instruction = FORMS["gs-load-rcx"]
         image = make_image("register", "unwind", body=instruction + b"\xc3")
         struct.pack_into("<I", image, 176, 0)
diff --git a/core/relinker/relinker/tests/test_tls_function_coverage.py b/core/relinker/relinker/tests/test_tls_function_coverage.py
index 455ed7cef1..7786496c9e 100644
--- a/core/relinker/relinker/tests/test_tls_function_coverage.py
+++ b/core/relinker/relinker/tests/test_tls_function_coverage.py
@@ -792,6 +792,19 @@ def main():
                 assert result.returncode == 0, (name, result.stdout, result.stderr)
                 patched = pe_bytes_at(output.read_bytes(), 0x11240, len(instruction) + 1)
                 assert patched == b"\x0f\x0b" + b"\x90" * (len(instruction) - 2) + b"\xc3", (name, patched.hex())
+            for name, instruction in {
+                "gs-nop": bytes.fromhex("65 90"),
+                "gs-register-move": bytes.fromhex("65 48 89 c8"),
+                "gs-cpuid": bytes.fromhex("65 0f a2"),
+            }.items():
+                source = work / (name + ".elf")
+                output = source.with_suffix(".exe")
+                source.write_bytes(make_image("register", "unwind", body=instruction + b"\xc3"))
+                result = subprocess.run([str(relinker), "--skip-sce-module", "--windows", str(source), str(output)],
+                                        capture_output=True, text=True, timeout=30)
+                assert result.returncode == 0, (name, result.stdout, result.stderr)
+                patched = pe_bytes_at(output.read_bytes(), 0x11240, len(instruction) + 1)
+                assert patched == instruction + b"\xc3", (name, patched.hex())
             instruction = bytes.fromhex("65 48 8b 0c 25 78 03 00 00")
             image = make_image("register", "unwind", body=instruction + b"\xc3")
             struct.pack_into("<I", image, 176, 0)
diff --git a/docs/dev/debt/relinker.md b/docs/dev/debt/relinker.md
index 29bd9bf4f8..24cad2e347 100644
--- a/docs/dev/debt/relinker.md
+++ b/docs/dev/debt/relinker.md
@@ -21,7 +21,7 @@
 - The [syscall scan of `sce_module` modules](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) with a `PT_SCE_DYNLIBDATA` segment stops at the same end, or, when the PLT comes before the code, at the end of the last function of the unwind table; code after it is not scanned.
 - In executables and guest modules with a `PT_SCE_DYNLIBDATA` segment, the [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp) of the Windows and macOS outputs follows code only from the end of `PT_INTERP`, or of the `/libexec/ld-elf.so.1` string that begins the segment when no `PT_INTERP` covers it, as in OpenOrbis modules, to the end of the PLT after the last function of the unwind table, or to the end of that function when the PLT comes before the code, as in the `libSceFios2.prx` and `libc.prx` that CUSA02636 bundles (PLT at 0xc8); the pipeline's scans of executables above stop at this same end, also when the PLT comes before the code. A guest module with PLT relocations and no PLT before or after its unwind functions, or with a PLT that overlaps one, fails as the executable does. Code after that end is not analyzed, such as the `DT_FINI` routine without an unwind entry that follows the last unwind function in both modules and that the Windows and macOS outputs call when the program exits: a TLS access in it is not rewritten, the ELF entry point, `DT_INIT`, `DT_FINI`, a branch or a pointer into it is ignored, and a function symbol or init/fini array entry pointing into it fails the conversion.
 - A relocation against a dynamic symbol entry that is all zero, like the null symbol, takes the value 0 plus its addend, as the gABI defines for `STN_UNDEF` ([pipeline](../../../core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp)). The Linux output imports such an entry as an unnamed weak symbol, which the host loader resolves to 0; the Windows and macOS outputs write the value into the slot ([relocation builder](../../../core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp)). What the console's loader does with such an entry is not measured. OliSe Player (PPSA01153) has seven of them, and its code calls through those slots only when they are not 0 ([#4437](https://github.com/boykopovar/AnyPS5/issues/4437)).
-- In macOS output, a guest instruction with a GS segment prefix, including one with no memory operand (`65 90`, `65 48 89 c8`), which does not touch GS, becomes `UD2` and NOP padding of its own length ([macOS image writer](../../../core/relinker/elfpatcher/src/macos/MacOsImage.cpp)): the host owns GS, which holds the pthread TSD base the guest TLS stubs read, and the guest GS base that FreeBSD's `sysarch(AMD64_SET_GSBASE)` would set is not emulated. A converted module runs until such an instruction is reached, which then faults. Prospero Win (PPSA99995) has six in its Wine `ntdll`.
+- In macOS output, a guest instruction that addresses memory through GS becomes `UD2` and NOP padding of its own length ([macOS image writer](../../../core/relinker/elfpatcher/src/macos/MacOsImage.cpp)): the host owns GS, which holds the pthread TSD base the guest TLS stubs read, and the guest GS base that FreeBSD's `sysarch(AMD64_SET_GSBASE)` would set is not emulated. A converted module runs until such an instruction is reached, which then faults. Prospero Win (PPSA99995) has six in its Wine `ntdll`.
 - The Linux placement of the `--to-intel` stubs in the [ELF patcher](../../../core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp) is covered only by a synthetic test.
 - `--to-rosetta` lowers what Rosetta lacks on top of `--to-intel` ([matcher](../../../core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp)). AVX2, FMA, BMI1/2, F16C and MOVBE were observed to execute on an M5 Max without being reported through CPUID; this is not a guarantee for other Rosetta hosts. ANDN and RDRAND fault on an M1 running macOS 15.3.1 and execute on an M1 running macOS 26.6.2, so on the M1 the difference follows the macOS version; on that host BEXTR, BLSI, BLSMSK, BLSR, TZCNT, LZCNT, POPCNT, BZHI, MULX, PDEP, PEXT, RORX, SARX, SHLX, SHRX, MOVBE, FMA, AVX2 and F16C execute as well, its CPUID leaf 1 reports none of MOVBE, FMA, AVX or F16C, and RDSEED, RDPID, CLWB, ADCX and ADOX raise SIGILL. They also execute on an M5 running macOS 26.4, where the rest of BMI1 and BMI2, LZCNT, PREFETCHW, CLFLUSHOPT, AVX, AVX2, FMA, F16C and MOVBE execute as well although CPUID leaf 7 reads zero and leaves 1 and 0x80000001 report none of them, and where RDSEED, CLWB, RDPID, ADCX and ADOX raise an illegal instruction. ANDN is lowered, but RDRAND and other BMI instructions still depend on the host. RDSEED becomes RDRAND and CLWB a NOP. RDPID returns processor 0, and RDTSCP runs unchanged with ECX set to 0 after it, because Rosetta's TSC_AUX is the constant 0xAAAAAAAB (also measured on an M5, macOS 27.0.1). An RDPID or RDTSCP site with no movable instruction after it for the jump is kept; a kept RDTSCP reports 0xAAAAAAAB. ADCX/ADOX fault under Rosetta and are not converted: compilers do not emit them, and code that checks CPUID sees no ADX. The conversions are covered by the converter tests. ANDN lowering is also executed by an x86-64 test build under Rosetta on the M1; the other conversions were originally checked on an M5 Max, outside this repository's CI.
 - `--to-intel` replaces the approximate legacy SSE and VEX.128 register forms of RSQRTPS/RCPPS and VRSQRTPS/VRCPPS with [correctly rounded](../../../core/relinker/codegen/src/x86/ReciprocalLowering.cpp) 1/sqrt(x) and 1/x, not with the AMD approximation: its tables are not public. Intel's approximation of 1/sqrt(1.0) is 0x3F7FF000, and two Newton-Raphson steps on it settle on 0.99999994 instead of 1.0; a renormalised identity quaternion then turns into a NaN axis in PPSA21564, which the console does not show. Refined results now reach the exact value; unrefined ones can still differ from the console in the low bits. Each site costs an out-of-line stub (two jumps, a spill below the red zone, SQRTPS/DIVPS). Legacy SSE forms preserve the destination's upper YMM bits; VEX forms clear them. The 256-bit, scalar and memory forms keep the native instruction, as does a site shorter than 5 bytes with no movable instruction after it for the jump (5 sites in PPSA21564, counted before a following RIP-relative instruction could move into the stub; not recounted).

From cde44070e02503999da624d3a3242c2ddefb89d3 Mon Sep 17 00:00:00 2001
From: aasishdairel <aasishdairel@gmail.com>
Date: Tue, 20 Oct 2026 10:13:29 +0530
Subject: [PATCH 2/5] fix(relinker): trap GS overrides on implicit memory
 operands

MASKMOVQ, MASKMOVDQU, VMASKMOVDQU, MONITOR and MONITORX use a register-form ModRM byte but still access memory at DS:rDI or DS:rAX. Mark them as memory operands and cover the encodings in the Windows and macOS GS trap tests.
---
 .../codegen/x86/X64OpcodeConstants.hpp        |  1 +
 .../codegen/src/x86/X64InstructionDecoder.cpp | 19 +++++++++++++++++--
 .../codegen/tests/DecoderLengthTests.cpp      |  7 +++++++
 .../relinker/tests/test_macos_gs_traps.py     |  6 ++++++
 .../tests/test_tls_function_coverage.py       |  6 ++++++
 5 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/core/relinker/codegen/include/codegen/x86/X64OpcodeConstants.hpp b/core/relinker/codegen/include/codegen/x86/X64OpcodeConstants.hpp
index 7a9a14a364..c6db778a9e 100644
--- a/core/relinker/codegen/include/codegen/x86/X64OpcodeConstants.hpp
+++ b/core/relinker/codegen/include/codegen/x86/X64OpcodeConstants.hpp
@@ -146,6 +146,7 @@ inline constexpr std::uint8_t TwoByteMovdMovq = 0x7E;
 inline constexpr std::uint8_t TwoByteMovqMmxXmm = 0x6F;
 inline constexpr std::uint8_t TwoByteMovdqu = 0x7F;
 inline constexpr std::uint8_t TwoByteGrp7 = 0x01;
+inline constexpr std::uint8_t TwoByteMaskmov = 0xF7;
 inline constexpr std::uint8_t TwoByteShiftImm8Min = 0x70;
 inline constexpr std::uint8_t TwoByteShiftImm8Max = 0x73;
 inline constexpr std::uint8_t ThreeByteEscape38 = 0x38;
diff --git a/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp b/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
index 5c93d00390..25c18b4f46 100644
--- a/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
+++ b/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
@@ -406,9 +406,17 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
 
     const bool xop = op == XopPrefix && pos < info.Length && (data[pos] & Vex3MapMask) >= XopMapMin;
     if (op == OneByteVex2 || op == OneByteVex3 || op == EvexPrefix || xop) {
-        pos += (op == OneByteVex2 ? 1 : (op == OneByteVex3 || xop ? 2 : EvexPrefixLength - 1)) + 1;
-        if (pos < info.Length)
+        const bool vex = op == OneByteVex2 || op == OneByteVex3;
+        const std::size_t vectorOpcodeOffset = pos + (op == OneByteVex2 ? 1 : (op == OneByteVex3 || xop ? 2 : EvexPrefixLength - 1));
+        const std::uint8_t vexMap = op == OneByteVex2 ? 1 : (data[pos] & (op == EvexPrefix ? EvexMapMask : Vex3MapMask));
+        const std::uint8_t vectorOpcode = vectorOpcodeOffset < info.Length ? data[vectorOpcodeOffset] : 0;
+        pos = vectorOpcodeOffset + 1;
+        if (pos < info.Length) {
             readModRm(pos, false);
+            if (vex && vexMap == 1 && vectorOpcode == TwoByteMaskmov &&
+                ((info.ModRmByte >> ModRmModShift) & ModRmModMask) == ModRmModRegister)
+                info.HasMemoryOperand = true;
+        }
         info.FlowKind = ControlFlowKind::Sequential;
         return info;
     }
@@ -596,6 +604,13 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
     if (hasModRm && pos < info.Length)
         readModRm(pos, twoByteOpcode && op >= TwoByteMovCrDrMin && op <= TwoByteMovCrDrMax);
 
+    if (info.HasModRm && twoByteOpcode) {
+        if (op == TwoByteMaskmov && ((info.ModRmByte >> ModRmModShift) & ModRmModMask) == ModRmModRegister)
+            info.HasMemoryOperand = true;
+        else if (op == TwoByteGrp7 && (info.ModRmByte == 0xC8 || info.ModRmByte == 0xFA))
+            info.HasMemoryOperand = true;
+    }
+
     if (!twoByteOpcode && ((op >= 0x6c && op <= 0x6f) || (op >= 0xa0 && op <= 0xa7) ||
                            (op >= 0xaa && op <= 0xaf) || op == 0xd7))
         info.HasMemoryOperand = true;
diff --git a/core/relinker/codegen/tests/DecoderLengthTests.cpp b/core/relinker/codegen/tests/DecoderLengthTests.cpp
index e7c7340696..433468fa56 100644
--- a/core/relinker/codegen/tests/DecoderLengthTests.cpp
+++ b/core/relinker/codegen/tests/DecoderLengthTests.cpp
@@ -123,6 +123,13 @@ int main() {
             {"65488b0c2578030000", true},
             {"65a4", true},
             {"650fa2", false},
+            {"650ff7c1", true},
+            {"65660ff7c1", true},
+            {"65c5f9f7c1", true},
+            {"65c4e179f7c1", true},
+            {"650f01c8", true},
+            {"650f01fa", true},
+            {"650f01c9", false},
             {"ff10", true},
             {"ffe0", false},
         }) {
diff --git a/core/relinker/relinker/tests/test_macos_gs_traps.py b/core/relinker/relinker/tests/test_macos_gs_traps.py
index 9f67360693..2cc7d050ed 100644
--- a/core/relinker/relinker/tests/test_macos_gs_traps.py
+++ b/core/relinker/relinker/tests/test_macos_gs_traps.py
@@ -15,12 +15,18 @@ FORMS = {
     "gs-store": bytes.fromhex("65 48 89 04 25 30 00 00 00"),
     "gs-alu": bytes.fromhex("65 48 33 04 25 28 00 00 00"),
     "gs-short-register-address": bytes.fromhex("65 48 8b 00"),
+    "gs-maskmovdqu": bytes.fromhex("65 66 0f f7 c1"),
+    "gs-maskmovq": bytes.fromhex("65 0f f7 c1"),
+    "gs-vmaskmovdqu": bytes.fromhex("65 c5 f9 f7 c1"),
+    "gs-monitor": bytes.fromhex("65 0f 01 c8"),
+    "gs-monitorx": bytes.fromhex("65 0f 01 fa"),
 }
 
 NON_MEMORY_FORMS = {
     "gs-nop": bytes.fromhex("65 90"),
     "gs-register-move": bytes.fromhex("65 48 89 c8"),
     "gs-cpuid": bytes.fromhex("65 0f a2"),
+    "gs-mwait": bytes.fromhex("65 0f 01 c9"),
 }
 
 
diff --git a/core/relinker/relinker/tests/test_tls_function_coverage.py b/core/relinker/relinker/tests/test_tls_function_coverage.py
index 7786496c9e..9d59c63b5d 100644
--- a/core/relinker/relinker/tests/test_tls_function_coverage.py
+++ b/core/relinker/relinker/tests/test_tls_function_coverage.py
@@ -783,6 +783,11 @@ def main():
                 "gs-store": bytes.fromhex("65 48 89 04 25 30 00 00 00"),
                 "gs-alu": bytes.fromhex("65 48 33 04 25 28 00 00 00"),
                 "gs-short-register-address": bytes.fromhex("65 48 8b 00"),
+                "gs-maskmovdqu": bytes.fromhex("65 66 0f f7 c1"),
+                "gs-maskmovq": bytes.fromhex("65 0f f7 c1"),
+                "gs-vmaskmovdqu": bytes.fromhex("65 c5 f9 f7 c1"),
+                "gs-monitor": bytes.fromhex("65 0f 01 c8"),
+                "gs-monitorx": bytes.fromhex("65 0f 01 fa"),
             }.items():
                 source = work / (name + ".elf")
                 output = source.with_suffix(".exe")
@@ -796,6 +801,7 @@ def main():
                 "gs-nop": bytes.fromhex("65 90"),
                 "gs-register-move": bytes.fromhex("65 48 89 c8"),
                 "gs-cpuid": bytes.fromhex("65 0f a2"),
+                "gs-mwait": bytes.fromhex("65 0f 01 c9"),
             }.items():
                 source = work / (name + ".elf")
                 output = source.with_suffix(".exe")

From a58d560c9bf505e14a86c71061f3d834b62d7708 Mon Sep 17 00:00:00 2001
From: aasishdairel <aasishdairel@gmail.com>
Date: Tue, 20 Oct 2026 10:19:04 +0530
Subject: [PATCH 3/5] fix(relinker): trap UMONITOR GS overrides

UMONITOR (F3 0F AE /6) takes its effective address from the register operand and uses DS with segment overrides, so mark its register-form encoding as a memory operand. UMWAIT and TPAUSE use the same opcode with F2/66 and have no memory operand.
---
 core/relinker/codegen/src/x86/X64InstructionDecoder.cpp  | 9 ++++++++-
 core/relinker/codegen/tests/DecoderLengthTests.cpp       | 4 ++++
 core/relinker/relinker/tests/test_macos_gs_traps.py      | 2 ++
 .../relinker/tests/test_tls_function_coverage.py         | 2 ++
 4 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp b/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
index 25c18b4f46..7082938042 100644
--- a/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
+++ b/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
@@ -356,6 +356,7 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
 
     std::size_t pos = 0;
     bool operandSizeOverride = false;
+    bool repPrefix = false;
 
     while (pos < info.Length) {
         std::uint8_t b = data[pos];
@@ -374,6 +375,8 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
                 info.AddressSize32 = true;
             if (b == PrefixOperandSize)
                 operandSizeOverride = true;
+            if (b == PrefixRep)
+                repPrefix = true;
             info.RexPrefix = 0;
             ++pos;
             continue;
@@ -605,10 +608,14 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
         readModRm(pos, twoByteOpcode && op >= TwoByteMovCrDrMin && op <= TwoByteMovCrDrMax);
 
     if (info.HasModRm && twoByteOpcode) {
-        if (op == TwoByteMaskmov && ((info.ModRmByte >> ModRmModShift) & ModRmModMask) == ModRmModRegister)
+        const std::uint8_t mod = (info.ModRmByte >> ModRmModShift) & ModRmModMask;
+        const std::uint8_t reg = (info.ModRmByte >> ModRmRegShift) & ModRmRegMask;
+        if (op == TwoByteMaskmov && mod == ModRmModRegister)
             info.HasMemoryOperand = true;
         else if (op == TwoByteGrp7 && (info.ModRmByte == 0xC8 || info.ModRmByte == 0xFA))
             info.HasMemoryOperand = true;
+        else if (op == TwoByteGrp15 && repPrefix && reg == 6 && mod == ModRmModRegister)
+            info.HasMemoryOperand = true;
     }
 
     if (!twoByteOpcode && ((op >= 0x6c && op <= 0x6f) || (op >= 0xa0 && op <= 0xa7) ||
diff --git a/core/relinker/codegen/tests/DecoderLengthTests.cpp b/core/relinker/codegen/tests/DecoderLengthTests.cpp
index 433468fa56..697c200fa3 100644
--- a/core/relinker/codegen/tests/DecoderLengthTests.cpp
+++ b/core/relinker/codegen/tests/DecoderLengthTests.cpp
@@ -130,6 +130,10 @@ int main() {
             {"650f01c8", true},
             {"650f01fa", true},
             {"650f01c9", false},
+            {"65f30faef0", true},
+            {"f20faef0", false},
+            {"660faef0", false},
+            {"f30faee8", false},
             {"ff10", true},
             {"ffe0", false},
         }) {
diff --git a/core/relinker/relinker/tests/test_macos_gs_traps.py b/core/relinker/relinker/tests/test_macos_gs_traps.py
index 2cc7d050ed..368c0a60c8 100644
--- a/core/relinker/relinker/tests/test_macos_gs_traps.py
+++ b/core/relinker/relinker/tests/test_macos_gs_traps.py
@@ -20,6 +20,7 @@ FORMS = {
     "gs-vmaskmovdqu": bytes.fromhex("65 c5 f9 f7 c1"),
     "gs-monitor": bytes.fromhex("65 0f 01 c8"),
     "gs-monitorx": bytes.fromhex("65 0f 01 fa"),
+    "gs-umonitor": bytes.fromhex("65 f3 0f ae f0"),
 }
 
 NON_MEMORY_FORMS = {
@@ -27,6 +28,7 @@ NON_MEMORY_FORMS = {
     "gs-register-move": bytes.fromhex("65 48 89 c8"),
     "gs-cpuid": bytes.fromhex("65 0f a2"),
     "gs-mwait": bytes.fromhex("65 0f 01 c9"),
+    "gs-umwait": bytes.fromhex("65 f2 0f ae f0"),
 }
 
 
diff --git a/core/relinker/relinker/tests/test_tls_function_coverage.py b/core/relinker/relinker/tests/test_tls_function_coverage.py
index 9d59c63b5d..99fec2aae4 100644
--- a/core/relinker/relinker/tests/test_tls_function_coverage.py
+++ b/core/relinker/relinker/tests/test_tls_function_coverage.py
@@ -788,6 +788,7 @@ def main():
                 "gs-vmaskmovdqu": bytes.fromhex("65 c5 f9 f7 c1"),
                 "gs-monitor": bytes.fromhex("65 0f 01 c8"),
                 "gs-monitorx": bytes.fromhex("65 0f 01 fa"),
+                "gs-umonitor": bytes.fromhex("65 f3 0f ae f0"),
             }.items():
                 source = work / (name + ".elf")
                 output = source.with_suffix(".exe")
@@ -802,6 +803,7 @@ def main():
                 "gs-register-move": bytes.fromhex("65 48 89 c8"),
                 "gs-cpuid": bytes.fromhex("65 0f a2"),
                 "gs-mwait": bytes.fromhex("65 0f 01 c9"),
+                "gs-umwait": bytes.fromhex("65 f2 0f ae f0"),
             }.items():
                 source = work / (name + ".elf")
                 output = source.with_suffix(".exe")

From a0e591c9323814af8f75333a941bbc6b0a03c2f4 Mon Sep 17 00:00:00 2001
From: aasishdairel <aasishdairel@gmail.com>
Date: Tue, 20 Oct 2026 10:53:42 +0530
Subject: [PATCH 4/5] fix(relinker): trap CLZERO GS overrides

CLZERO (0F 01 FC) clears the cache line at the logical address in rAX and applies a GS override, so mark its register-form encoding as a memory operand. RDPRU (0F 01 FD) has no memory operand and stays unchanged.
---
 core/relinker/codegen/src/x86/X64InstructionDecoder.cpp    | 2 +-
 core/relinker/codegen/tests/DecoderLengthTests.cpp         | 2 ++
 core/relinker/relinker/tests/test_macos_gs_traps.py        | 2 ++
 core/relinker/relinker/tests/test_tls_function_coverage.py | 2 ++
 4 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp b/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
index 7082938042..b22c3f8726 100644
--- a/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
+++ b/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
@@ -612,7 +612,7 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
         const std::uint8_t reg = (info.ModRmByte >> ModRmRegShift) & ModRmRegMask;
         if (op == TwoByteMaskmov && mod == ModRmModRegister)
             info.HasMemoryOperand = true;
-        else if (op == TwoByteGrp7 && (info.ModRmByte == 0xC8 || info.ModRmByte == 0xFA))
+        else if (op == TwoByteGrp7 && (info.ModRmByte == 0xC8 || info.ModRmByte == 0xFA || info.ModRmByte == 0xFC))
             info.HasMemoryOperand = true;
         else if (op == TwoByteGrp15 && repPrefix && reg == 6 && mod == ModRmModRegister)
             info.HasMemoryOperand = true;
diff --git a/core/relinker/codegen/tests/DecoderLengthTests.cpp b/core/relinker/codegen/tests/DecoderLengthTests.cpp
index 697c200fa3..3ad1299b0d 100644
--- a/core/relinker/codegen/tests/DecoderLengthTests.cpp
+++ b/core/relinker/codegen/tests/DecoderLengthTests.cpp
@@ -129,7 +129,9 @@ int main() {
             {"65c4e179f7c1", true},
             {"650f01c8", true},
             {"650f01fa", true},
+            {"650f01fc", true},
             {"650f01c9", false},
+            {"650f01fd", false},
             {"65f30faef0", true},
             {"f20faef0", false},
             {"660faef0", false},
diff --git a/core/relinker/relinker/tests/test_macos_gs_traps.py b/core/relinker/relinker/tests/test_macos_gs_traps.py
index 368c0a60c8..de0426bc5f 100644
--- a/core/relinker/relinker/tests/test_macos_gs_traps.py
+++ b/core/relinker/relinker/tests/test_macos_gs_traps.py
@@ -20,6 +20,7 @@ FORMS = {
     "gs-vmaskmovdqu": bytes.fromhex("65 c5 f9 f7 c1"),
     "gs-monitor": bytes.fromhex("65 0f 01 c8"),
     "gs-monitorx": bytes.fromhex("65 0f 01 fa"),
+    "gs-clzero": bytes.fromhex("65 0f 01 fc"),
     "gs-umonitor": bytes.fromhex("65 f3 0f ae f0"),
 }
 
@@ -28,6 +29,7 @@ NON_MEMORY_FORMS = {
     "gs-register-move": bytes.fromhex("65 48 89 c8"),
     "gs-cpuid": bytes.fromhex("65 0f a2"),
     "gs-mwait": bytes.fromhex("65 0f 01 c9"),
+    "gs-rdpru": bytes.fromhex("65 0f 01 fd"),
     "gs-umwait": bytes.fromhex("65 f2 0f ae f0"),
 }
 
diff --git a/core/relinker/relinker/tests/test_tls_function_coverage.py b/core/relinker/relinker/tests/test_tls_function_coverage.py
index 99fec2aae4..dfe3918c87 100644
--- a/core/relinker/relinker/tests/test_tls_function_coverage.py
+++ b/core/relinker/relinker/tests/test_tls_function_coverage.py
@@ -788,6 +788,7 @@ def main():
                 "gs-vmaskmovdqu": bytes.fromhex("65 c5 f9 f7 c1"),
                 "gs-monitor": bytes.fromhex("65 0f 01 c8"),
                 "gs-monitorx": bytes.fromhex("65 0f 01 fa"),
+                "gs-clzero": bytes.fromhex("65 0f 01 fc"),
                 "gs-umonitor": bytes.fromhex("65 f3 0f ae f0"),
             }.items():
                 source = work / (name + ".elf")
@@ -803,6 +804,7 @@ def main():
                 "gs-register-move": bytes.fromhex("65 48 89 c8"),
                 "gs-cpuid": bytes.fromhex("65 0f a2"),
                 "gs-mwait": bytes.fromhex("65 0f 01 c9"),
+                "gs-rdpru": bytes.fromhex("65 0f 01 fd"),
                 "gs-umwait": bytes.fromhex("65 f2 0f ae f0"),
             }.items():
                 source = work / (name + ".elf")

From 0d3f6f7262b5e878762cb35668397cb5ece3731b Mon Sep 17 00:00:00 2001
From: aasishdairel <aasishdairel@gmail.com>
Date: Tue, 20 Oct 2026 21:54:30 +0530
Subject: [PATCH 5/5] test(relinker): split GS trap coverage groups

The Windows gs_traps group grew to 21 relinker invocations and ran close to its 30 s CTest timeout on a loaded host. Split the implicit-memory cases into gs_traps_implicit so each group stays well under the limit, and share the per-case check between them.
---
 core/relinker/CMakeLists.txt                  |  2 +-
 .../tests/test_tls_function_coverage.py       | 79 ++++++++++---------
 2 files changed, 41 insertions(+), 40 deletions(-)

diff --git a/core/relinker/CMakeLists.txt b/core/relinker/CMakeLists.txt
index d2a3387683..ec14856671 100644
--- a/core/relinker/CMakeLists.txt
+++ b/core/relinker/CMakeLists.txt
@@ -474,7 +474,7 @@ if(BUILD_TESTING)
         foreach(opcode IN ITEMS add or adc sbb and sub xor cmp)
             list(APPEND tlsCoverageGroups alu_${opcode})
         endforeach()
-        list(APPEND tlsCoverageGroups gs_traps)
+        list(APPEND tlsCoverageGroups gs_traps gs_traps_implicit)
         foreach(group IN LISTS tlsCoverageGroups)
             add_test(NAME tls_function_coverage_${group} COMMAND ${Python3_EXECUTABLE}
                 ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_tls_function_coverage.py $<TARGET_FILE:relinker> ${group})
diff --git a/core/relinker/relinker/tests/test_tls_function_coverage.py b/core/relinker/relinker/tests/test_tls_function_coverage.py
index dfe3918c87..7de43350f9 100644
--- a/core/relinker/relinker/tests/test_tls_function_coverage.py
+++ b/core/relinker/relinker/tests/test_tls_function_coverage.py
@@ -530,7 +530,7 @@ def add_alias(image, size, begin=0x1200):
 
 def main():
     groups = ("metadata", "padding", "register_loads", "displacement_bounds", "alu_execution",
-              "register_address_loads", "moved_branch", "rejected", "gs_traps")
+              "register_address_loads", "moved_branch", "rejected", "gs_traps", "gs_traps_implicit")
     groups += tuple(f"displacement_r{register}" for register in range(16) if register != 4)
     groups += tuple(f"alu_{name}" for name in ALU_READ)
     parser = argparse.ArgumentParser(description="Run Windows guest TLS function coverage fixtures")
@@ -776,45 +776,33 @@ def main():
             conflicting[232:344] = unwind[232:344]
             struct.pack_into("<H", conflicting, 56, 5)
             convert("conflicting-function-extents", conflicting, "Code analysis: conflicting function ranges")
+
+        def check_gs_traps(cases):
+            for name, instruction, trapped in cases:
+                source = work / (name + ".elf")
+                output = source.with_suffix(".exe")
+                source.write_bytes(make_image("register", "unwind", body=instruction + b"\xc3"))
+                result = subprocess.run([str(relinker), "--skip-sce-module", "--windows", str(source), str(output)],
+                                        capture_output=True, text=True, timeout=30)
+                assert result.returncode == 0, (name, result.stdout, result.stderr)
+                patched = pe_bytes_at(output.read_bytes(), 0x11240, len(instruction) + 1)
+                if trapped:
+                    expected = b"\x0f\x0b" + b"\x90" * (len(instruction) - 2) + b"\xc3"
+                else:
+                    expected = instruction + b"\xc3"
+                assert patched == expected, (name, patched.hex())
+
         if args.group in ("all", "gs_traps"):
-            for name, instruction in {
-                "gs-load-rcx": bytes.fromhex("65 48 8b 0c 25 78 03 00 00"),
-                "gs-load-r13": bytes.fromhex("65 4c 8b 2c 25 30 00 00 00"),
-                "gs-store": bytes.fromhex("65 48 89 04 25 30 00 00 00"),
-                "gs-alu": bytes.fromhex("65 48 33 04 25 28 00 00 00"),
-                "gs-short-register-address": bytes.fromhex("65 48 8b 00"),
-                "gs-maskmovdqu": bytes.fromhex("65 66 0f f7 c1"),
-                "gs-maskmovq": bytes.fromhex("65 0f f7 c1"),
-                "gs-vmaskmovdqu": bytes.fromhex("65 c5 f9 f7 c1"),
-                "gs-monitor": bytes.fromhex("65 0f 01 c8"),
-                "gs-monitorx": bytes.fromhex("65 0f 01 fa"),
-                "gs-clzero": bytes.fromhex("65 0f 01 fc"),
-                "gs-umonitor": bytes.fromhex("65 f3 0f ae f0"),
-            }.items():
-                source = work / (name + ".elf")
-                output = source.with_suffix(".exe")
-                source.write_bytes(make_image("register", "unwind", body=instruction + b"\xc3"))
-                result = subprocess.run([str(relinker), "--skip-sce-module", "--windows", str(source), str(output)],
-                                        capture_output=True, text=True, timeout=30)
-                assert result.returncode == 0, (name, result.stdout, result.stderr)
-                patched = pe_bytes_at(output.read_bytes(), 0x11240, len(instruction) + 1)
-                assert patched == b"\x0f\x0b" + b"\x90" * (len(instruction) - 2) + b"\xc3", (name, patched.hex())
-            for name, instruction in {
-                "gs-nop": bytes.fromhex("65 90"),
-                "gs-register-move": bytes.fromhex("65 48 89 c8"),
-                "gs-cpuid": bytes.fromhex("65 0f a2"),
-                "gs-mwait": bytes.fromhex("65 0f 01 c9"),
-                "gs-rdpru": bytes.fromhex("65 0f 01 fd"),
-                "gs-umwait": bytes.fromhex("65 f2 0f ae f0"),
-            }.items():
-                source = work / (name + ".elf")
-                output = source.with_suffix(".exe")
-                source.write_bytes(make_image("register", "unwind", body=instruction + b"\xc3"))
-                result = subprocess.run([str(relinker), "--skip-sce-module", "--windows", str(source), str(output)],
-                                        capture_output=True, text=True, timeout=30)
-                assert result.returncode == 0, (name, result.stdout, result.stderr)
-                patched = pe_bytes_at(output.read_bytes(), 0x11240, len(instruction) + 1)
-                assert patched == instruction + b"\xc3", (name, patched.hex())
+            check_gs_traps([
+                ("gs-load-rcx", bytes.fromhex("65 48 8b 0c 25 78 03 00 00"), True),
+                ("gs-load-r13", bytes.fromhex("65 4c 8b 2c 25 30 00 00 00"), True),
+                ("gs-store", bytes.fromhex("65 48 89 04 25 30 00 00 00"), True),
+                ("gs-alu", bytes.fromhex("65 48 33 04 25 28 00 00 00"), True),
+                ("gs-short-register-address", bytes.fromhex("65 48 8b 00"), True),
+                ("gs-nop", bytes.fromhex("65 90"), False),
+                ("gs-register-move", bytes.fromhex("65 48 89 c8"), False),
+                ("gs-cpuid", bytes.fromhex("65 0f a2"), False),
+            ])
             instruction = bytes.fromhex("65 48 8b 0c 25 78 03 00 00")
             image = make_image("register", "unwind", body=instruction + b"\xc3")
             struct.pack_into("<I", image, 176, 0)
@@ -826,6 +814,19 @@ def main():
             assert result.returncode == 0, ("gs-without-pt-tls", result.stdout, result.stderr)
             patched = pe_bytes_at(output.read_bytes(), 0x11240, len(instruction) + 1)
             assert patched == b"\x0f\x0b" + b"\x90" * (len(instruction) - 2) + b"\xc3", ("gs-without-pt-tls", patched.hex())
+        if args.group in ("all", "gs_traps_implicit"):
+            check_gs_traps([
+                ("gs-maskmovdqu", bytes.fromhex("65 66 0f f7 c1"), True),
+                ("gs-maskmovq", bytes.fromhex("65 0f f7 c1"), True),
+                ("gs-vmaskmovdqu", bytes.fromhex("65 c5 f9 f7 c1"), True),
+                ("gs-monitor", bytes.fromhex("65 0f 01 c8"), True),
+                ("gs-monitorx", bytes.fromhex("65 0f 01 fa"), True),
+                ("gs-clzero", bytes.fromhex("65 0f 01 fc"), True),
+                ("gs-umonitor", bytes.fromhex("65 f3 0f ae f0"), True),
+                ("gs-mwait", bytes.fromhex("65 0f 01 c9"), False),
+                ("gs-rdpru", bytes.fromhex("65 0f 01 fd"), False),
+                ("gs-umwait", bytes.fromhex("65 f2 0f ae f0"), False),
+            ])
     print(f"TLS function coverage integration tests passed: {args.group}")