fix(relinker): find Windows guest TLS accesses in code no root reaches

The Windows TLS rewriter only patches instructions that
CodeInstructionCollector finds: symbol and unwind function ranges, plus
the code their branches, relocated pointers and initializers reach. A
fixed-address executable (ET_SCE_EXEC) has no relocations for function
pointers held in data, such as vtables or a thread entry loaded with
LEA, and its unwind tables need not cover every function. TLS accesses
in that code stayed `mov reg, fs:[0]`, which reads address 0 on Windows.

PPSA16064 (Minecraft Dungeons II, Unreal Engine) has 3689 such loads in
its executable segment; 478 were left unpatched, and its worker threads
faulted on their first TLS access at start-up.

The collector now also sweeps each executable segment linearly from the
first address that int3 padding precedes on a 16-byte boundary, and adds
every FS-prefixed instruction with an absolute disp32 operand as a root.
The sweep resynchronizes at the next padded 16-byte boundary when an
instruction does not decode, crosses such a boundary or starts with two
zero bytes, so zero-filled or undecodable bytes are not read as code.
The rewriter's own checks still decide which forms it can patch.

With this, all 3689 loads in PPSA16064 are patched. New cases in
tls_function_coverage: a padded function nothing references is patched,
and the same load behind zero fill after padding is left unchanged.

core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp

@@ -209,6 +209,44 @@ std::set<Domain::VirtualAddress> CodeInstructionCollector::Collect(const std::ve
             address += info.Length;
         }
     }
+    for (const auto& header : headers) {
+        if (header.Type != 1 || (header.Flags & 1) == 0 || header.FileSize < 16) continue;
+        range(header.Offset, header.FileSize);
+        const auto* text = bytes.data() + header.Offset;
+        const auto size = static_cast<std::size_t>(header.FileSize);
+        const auto paddedStart = [&](std::size_t address) { return address % 16 == 0 && address >= 2 && text[address - 1] == 0xcc && text[address - 2] == 0xcc; };
+        const auto nextPaddedStart = [&](std::size_t address) {
+            address = (address + 16) & ~std::size_t{15};
+            while (address < size && !paddedStart(address)) address += 16;
+            return address;
+        };
+        for (std::size_t position = nextPaddedStart(0); position < size;) {
+            if (position + 1 < size && text[position] == 0 && text[position + 1] == 0) {
+                position = nextPaddedStart(position);
+                continue;
+            }
+            Codegen::DecodedInstructionInfo info;
+            try {
+                info = decoder.DecodeInstruction(text + position, size - position);
+            } catch (const Codegen::CodegenException&) {
+                position = nextPaddedStart(position);
+                continue;
+            }
+            if (info.Length == 0 || info.Length > size - position) {
+                position = nextPaddedStart(position);
+                continue;
+            }
+            const auto next = position + info.Length;
+            const auto crossed = (position & ~std::size_t{15}) + 16;
+            if (crossed < next && paddedStart(crossed)) {
+                position = crossed;
+                continue;
+            }
+            const auto opcode = position + info.OpcodeOffset;
+            if (info.SegmentPrefix == 0x64 && opcode + 2 < next && (text[opcode + 1] & 0xc7) == 0x04 && text[opcode + 2] == 0x25) addRoot(header.MappedAddress + position);
+            position = next;
+        }
+    }
     for (const auto target : staticTargets) {
         for (const auto& [skipBegin, skipEnd] : skipped) {
             if (skipBegin <= target && target < skipEnd)

core/relinker/relinker/tests/test_tls_function_coverage.py

@@ -339,6 +339,28 @@ def main():
         external[0x1300:0x1310] = external[0x1240:0x1250]
         external[0x1240:0x1250] = b"\xe8" + struct.pack("<i", 0x1300 - 0x1245) + b"\xc3" + b"\x90" * 10
         convert("direct-call-from-indirect-block", external, tls_address=0x1300)
+
+        def convert_padded(name, image):
+            source = work / (name + ".elf")
+            output = source.with_suffix(".exe")
+            source.write_bytes(image)
+            result = subprocess.run([str(relinker), "--skip-sce-module", "--windows", str(source), str(output)],
+                                    capture_output=True, text=True, timeout=30)
+            assert result.returncode == 0, (name, result.stdout, result.stderr)
+            return output.read_bytes()
+
+        unreferenced = make_image("register", "unwind")
+        unreferenced[0x18f0:0x1900] = b"\xcc" * 16
+        unreferenced[0x1900:0x1900 + len(TLS_LOAD) + 4] = TLS_LOAD + bytes.fromhex("8b 40 f0 c3")
+        pe = convert_padded("unreferenced-padded-function", unreferenced)
+        assert pe_bytes_at(pe, 0x11900, 1)[0] == 0xe9, "unreferenced-padded-function"
+        assert pe_bytes_at(pe, 0x11850, len(TLS_LOAD)) == TLS_LOAD, "unreferenced-padded-function"
+        zero_filled = make_image("register", "unwind")
+        zero_filled[0x18f0:0x1900] = b"\xcc" * 16
+        zero_filled[0x1900:0x1910] = bytes(16)
+        zero_filled[0x1910:0x1910 + len(TLS_LOAD)] = TLS_LOAD
+        pe = convert_padded("zero-filled-after-padding", zero_filled)
+        assert pe_bytes_at(pe, 0x11910, len(TLS_LOAD)) == TLS_LOAD, "zero-filled-after-padding"
         for register in range(16):
             offset, body = register_load(register)
             image = make_image("register", "unwind", body=body)