[SuleimanKh97]

What

Addresses #3719. Sons of Sparta (PPSA28997) crashes in its guest libc with STATUS_ILLEGAL_INSTRUCTION at bytes c4 62 e9 f7 c0, which encode shlx r8, rax, rdx. The logged inputs (rax = 1, rdx = 0x25) require r8 = 0x2000000000 while preserving flags.

The Windows crash handler now emulates faulting SHLX, SHRX and SARX instructions on the saved thread context and resumes after the instruction. It supports 32-bit and 64-bit register operands and unprefixed 64-bit memory addressing, including SIB, signed displacements and RIP-relative operands. Unsupported encodings and failed memory reads leave the context untouched and continue through the existing fatal-reporting path.

Instruction semantics follow Intel SDM volume 2B, "SARX/SHLX/SHRX — Shift Without Affecting Flags". Known coverage and performance limits are recorded in TechnicalDebt.

Tested

Windows, MinGW-w64 GCC 15.2.0 (WinLibs x86_64-ucrt-posix-seh r7):

• Compiled the regression test translation unit, including the production crash handler, to assembly with -std=c++20 -O2 -Wall -Wextra -Werror.
• Checked the production crash handler separately with -fsyntax-only and the same warning settings.
• python tools/check_conventions.py --base origin/main passed.
• git diff --check passed.

Executable tests were not run: Windows Application Control blocks the assembler, and the bundled CMake also fails to start. No full library build or Sons of Sparta launch was performed. This PR remains a draft pending runtime validation.

Added a Windows CTest target, available in both full and relinker-only configurations. Tests cover the exact crash inputs, all register combinations, operand widths, masked shift counts, sign propagation, flags and unrelated-context preservation, memory addressing, truncation, unreadable memory, injected Windows exception recovery, and native BMI2 comparison when supported. These are authored tests, not reported passing runtime results.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed in TechnicalDebt (unsupported instructions retain fatal reporting; no silent stubs added)
• No notes, investigation .md files or images added to the repository
• New third-party code is a submodule built from source (none added)
• Generic behaviour, not specific to one title
• Depends on: none
• AI-assisted: yes

[oneandonlydean]

Closing now that #5705 is in: titles run natively, so a host CPU without BMI2 now stops at start-up with the CPU's name and the missing extensions. Emulating the faulting instructions would only cover the ones we trap, and the rest of a title's code is built for the same extensions. Thanks for digging into #3719.