[settings] nuke runtime tls patch (#4492) toggle (#4502)

Credit: Pavel
Fixes shadows in Metroid Prime Remastered

Broken
![image](/attachments/7c49b843-0184-4835-b14e-d93a0948dd56)
Fixed
![image](/attachments/2ba2eb43-fead-4fd4-9791-671aa518f282)

Needs to be tested
- Demon Slayer Vertex Explosions
- Ender Magnolia Freezing

- [x] I have read and followed the [Contribution Guidelines](https://git.eden-emu.dev/eden-emu/eden/src/branch/master/CONTRIBUTING.md#code-contributions).
- [x] I have read and followed the [AI Policy](https://git.eden-emu.dev/eden-emu/eden/src/branch/master/docs/policies/AI.md)
- [x] I have read and followed the [Coding Guidelines](https://git.eden-emu.dev/eden-emu/eden/src/branch/master/docs/policies/Coding.md) to the best of my ability.

-------------------

Co-authored-by: PavelBARABANOV <pavelbarabanov94@gmail.com>
Reviewed-on: https://git.eden-emu.dev/eden-emu/eden/pulls/4499
Reviewed-by: Maufeat <sahyno1996@gmail.com>
Reviewed-by: lizzie <lizzie@eden-emu.dev>
Reviewed-by: CamilleLaVey <camillelavey99@gmail.com>

src/android/app/src/main/java/org/yuzu/yuzu_emu/features/settings/model/BooleanSetting.kt

@@ -17,7 +17,6 @@ enum class BooleanSetting(override val key: String) : AbstractBooleanSetting {
     USE_CUSTOM_CPU_TICKS("use_custom_cpu_ticks"),
     SKIP_CPU_INNER_INVALIDATION("skip_cpu_inner_invalidation"),
     NCE_INVALIDATION_GPU_READBACK("nce_invalidation_gpu_readback"),
-    NCE_RUNTIME_NRO_PATCH("nce_runtime_nro_patch"),
     FIX_BLOOM_EFFECTS("fix_bloom_effects"),
     EMULATE_BGR565("emulate_bgr565"),
     RESCALE_HACK("rescale_hack"),

src/android/app/src/main/java/org/yuzu/yuzu_emu/features/settings/model/view/SettingsItem.kt

@@ -866,13 +866,6 @@ abstract class SettingsItem(
                     descriptionId = R.string.nce_invalidation_gpu_readback_description
                 )
             )
-            put(
-                SwitchSetting(
-                    BooleanSetting.NCE_RUNTIME_NRO_PATCH,
-                    titleId = R.string.nce_runtime_nro_patch,
-                    descriptionId = R.string.nce_runtime_nro_patch_description
-                )
-            )
             put(
                 SwitchSetting(
                     BooleanSetting.FIX_BLOOM_EFFECTS,

src/android/app/src/main/java/org/yuzu/yuzu_emu/features/settings/ui/SettingsFragmentPresenter.kt

@@ -555,7 +555,6 @@ class SettingsFragmentPresenter(
 
             add(BooleanSetting.SKIP_CPU_INNER_INVALIDATION.key)
             add(BooleanSetting.NCE_INVALIDATION_GPU_READBACK.key)
-            add(BooleanSetting.NCE_RUNTIME_NRO_PATCH.key)
             add(BooleanSetting.FIX_BLOOM_EFFECTS.key)
             add(BooleanSetting.EMULATE_BGR565.key)
             add(BooleanSetting.RENDERER_ASYNCHRONOUS_SHADERS.key)

src/android/app/src/main/res/values/strings.xml

@@ -595,8 +595,6 @@
     <string name="skip_cpu_inner_invalidation_description">Skips certain CPU-side cache invalidations during memory updates, reducing CPU usage and improving it\'s performance. This may cause glitches or crashes on some games.</string>
     <string name="nce_invalidation_gpu_readback">GPU Readback Before NCE Invalidation</string>
     <string name="nce_invalidation_gpu_readback_description">Temporary. Fix Ender Magnolia (and other UE titles) crashes. May reduce performance. Improvement in progress.</string>
-    <string name="nce_runtime_nro_patch">Patch Runtime NROs for NCE</string>
-    <string name="nce_runtime_nro_patch_description">Temporary. Fix Biomutant boot. May impact performance. Improvement in progress.</string>
     <string name="fix_bloom_effects">Fix Bloom Effects</string>
     <string name="fix_bloom_effects_description">Reduces bloom blur in LA/EOW (Adreno A6XX - A7XX/ Turnip), removes bloom in Burnout. Warning: may cause graphical artifacts in other games.</string>
     <string name="emulate_bgr565">Emulate BGR565</string>

src/common/settings.h

@@ -641,8 +641,6 @@ struct Values {
                                                         true};
     SwitchableSetting<bool> nce_invalidation_gpu_readback{
         linkage, false, "nce_invalidation_gpu_readback", Category::RendererHacks};
-    SwitchableSetting<bool> nce_runtime_nro_patch{
-        linkage, false, "nce_runtime_nro_patch", Category::RendererHacks};
     SwitchableSetting<bool> async_presentation{linkage,
 #ifdef __ANDROID__
                                                true,

src/core/arm/nce/patcher.cpp

@@ -45,6 +45,23 @@ Patcher::Patcher() : c(m_patch_instructions), c_pre(m_patch_instructions_pre) {
     WriteLoadContext(c_pre);
 }
 
+Patcher::Patcher(std::span<const u8> text) : c(m_patch_instructions), c_pre(m_patch_instructions_pre) {
+    modules.emplace_back();
+    curr_patch = &modules.back();
+    const auto words = std::span<const u32>{reinterpret_cast<const u32*>(text.data()), text.size() / sizeof(u32)};
+    for (u32 i = ModuleCodeIndex; i < static_cast<u32>(words.size()); ++i) {
+        const uintptr_t offset = i * sizeof(u32);
+        if (auto mrs = MRS{words[i]}; mrs.Verify() && mrs.GetRt() != 31 && (mrs.GetSystemReg() == TpidrEl0 || mrs.GetSystemReg() == TpidrroEl0)) {
+            BranchToPatch(offset);
+            const auto src_reg = mrs.GetSystemReg() == TpidrroEl0 ? oaknut::SystemReg::TPIDRRO_EL0 : oaknut::SystemReg::TPIDR_EL0;
+            WriteMrsHandler(offset + sizeof(u32), oaknut::XReg{static_cast<int>(mrs.GetRt())}, src_reg);
+        } else if (auto msr = MSR{words[i]}; msr.Verify() && msr.GetSystemReg() == TpidrEl0) {
+            BranchToPatch(offset);
+            WriteMsrHandler(offset + sizeof(u32), oaknut::XReg{static_cast<int>(msr.GetRt())});
+        }
+    }
+}
+
 Patcher::~Patcher() = default;
 
 bool Patcher::PatchText(std::span<const u8> program_image, const Kernel::CodeSet::Segment& code) {
@@ -182,6 +199,31 @@ bool Patcher::PatchText(std::span<const u8> program_image, const Kernel::CodeSet
     return true;
 }
 
+std::span<const u32> Patcher::RelocateRuntimeTls(
+    s64 patch_offset, std::vector<InstructionPatch>& out_patches) {
+    const auto& patch = modules.front();
+    const auto can_branch = [](s64 offset) {
+        return offset % 4 == 0 && offset >= -static_cast<s64>(MaxRelativeBranch) && offset < static_cast<s64>(MaxRelativeBranch);
+    };
+    out_patches.clear();
+    out_patches.reserve(patch.m_branch_to_patch_relocations.size());
+    for (const auto& rel : patch.m_branch_to_patch_relocations) {
+        const s64 offset = patch_offset + rel.patch_offset - static_cast<s64>(rel.module_offset);
+        if (!can_branch(offset)) {return {};}
+        u32 replacement;
+        oaknut::CodeGenerator rc{&replacement};
+        rc.B(offset);
+        out_patches.push_back({rel.module_offset, replacement});
+    }
+    for (const auto& rel : patch.m_branch_to_module_relocations) {
+        const s64 offset = static_cast<s64>(rel.module_offset) - patch_offset - rel.patch_offset;
+        if (!can_branch(offset)) {return {};}
+        oaknut::CodeGenerator rc{m_patch_instructions.data() + rel.patch_offset / sizeof(u32)};
+        rc.B(offset);
+    }
+    return m_patch_instructions;
+}
+
 bool Patcher::RelocateAndCopy(Common::ProcessAddress load_base, const Kernel::CodeSet::Segment& code, std::vector<u8>& program_image, EntryTrampolines* out_trampolines) {
     const size_t patch_size = GetSectionSize();
     const size_t pre_patch_size = GetPreSectionSize();

src/core/arm/nce/patcher.h

@@ -48,15 +48,22 @@ using ModuleTextAddress = u64;
 using PatchTextAddress = u64;
 using EntryTrampolines = ::Common::unordered_map<ModuleTextAddress, PatchTextAddress>;
 
+struct InstructionPatch {
+    u64 offset;
+    u32 replacement;
+};
+
 class Patcher {
 public:
     void SetModuleID(const ModuleID& id) {
         module_id = id;
     }
     explicit Patcher();
+    explicit Patcher(std::span<const u8> text);
     ~Patcher();
     bool PatchText(std::span<const u8> program_image, const Kernel::CodeSet::Segment& code);
     bool RelocateAndCopy(Common::ProcessAddress load_base, const Kernel::CodeSet::Segment& code, std::vector<u8>& program_image, EntryTrampolines* out_trampolines);
+    std::span<const u32> RelocateRuntimeTls(s64 patch_offset, std::vector<InstructionPatch>& out_patches);
     size_t GetSectionSize() const noexcept;
     size_t GetPreSectionSize() const noexcept;
 

src/core/file_sys/content_archive.cpp

@@ -45,7 +45,6 @@ NCA::NCA(VirtualFile file_, const NCA* base_nca, bool allow_missing_base)
     // Ensure we have the proper key area keys to continue.
     const u8 master_key_id = MasterKeyIdForKeyGeneration(reader->GetKeyGeneration());
     if (!keys.HasKey(Core::Crypto::S128KeyType::KeyArea, master_key_id, reader->GetKeyIndex())) {
-        LOG_ERROR(Loader, "Cannot decrypt {}: keys for gen 0x{:02X}+ required.", file->GetName(), reader->GetKeyGeneration());
         status = Loader::ResultStatus::ErrorMissingKeyAreaKey;
         return;
     }

src/core/hle/service/ro/ro.cpp

@@ -7,6 +7,7 @@
 #include <openssl/err.h>
 #include <openssl/evp.h>
 
+#include "common/scope_exit.h"
 #include "core/hle/kernel/k_process.h"
 
 #include "core/hle/service/cmif_serialization.h"
@@ -425,36 +426,51 @@ public:
         R_TRY(context->ValidateNro(std::addressof(nro_info->module_id), std::addressof(rx_size),
                                    std::addressof(ro_size), std::addressof(rw_size),
                                    nro_info->base_address, nro_size, bss_size));
+        R_TRY(SetNroPerms(context->GetProcess(), nro_info->base_address, rx_size, ro_size, rw_size + bss_size));
 #ifdef HAS_NCE
-        if (Settings::values.nce_runtime_nro_patch.GetValue()) {
-            if (Settings::IsNceEnabled()) {
-                auto* process = context->GetProcess();
-                auto& memory = process->GetMemory();
-
-                std::vector<u8> image(total_size);
-                memory.ReadBlock(nro_info->base_address, image.data(), rx_size);
-
-                Kernel::CodeSet::Segment code{.size = static_cast<u32>(rx_size)};
-                Core::NCE::Patcher patch;
-                patch.PatchText(image, code);
-                patch.RelocateAndCopy(nro_info->base_address, code, image, nullptr);
-
-                const u64 patch_address = nro_info->base_address + total_size;
-                const size_t patch_size = patch.GetSectionSize();
+        if (Settings::IsNceEnabled()) {
+            auto* process = context->GetProcess();
+            auto& memory = process->GetMemory();
+            std::vector<u8> text(rx_size);
+            memory.ReadBlock(nro_info->base_address, text.data(), text.size());
+            Core::NCE::Patcher patch{text};
+            const size_t patch_size = patch.GetSectionSize();
+            if (patch_size != 0) {
                 constexpr auto permission = Kernel::Svc::MemoryPermission::ReadExecute;
-
                 auto* patch_memory = Kernel::KSharedMemory::Create(kernel);
+                SCOPE_EXIT { patch_memory->Close(kernel); };
                 R_TRY(patch_memory->Initialize(kernel, kernel.System().DeviceMemory(), process, permission, permission, patch_size));
-                std::memcpy(patch_memory->GetPointer(), image.data() + total_size, patch_size);
-                R_TRY(process->AddSharedMemory(kernel, patch_memory, patch_address, patch_size));
-                R_TRY(patch_memory->Map(*process, patch_address, patch_size, permission));
-                memory.WriteBlock(nro_info->base_address, image.data(), rx_size);
+                Kernel::KSharedMemory::Register(kernel, patch_memory);
+                const std::array<s64, 2> offsets{static_cast<s64>(total_size + Kernel::PageSize),-static_cast<s64>(patch_size + Kernel::PageSize)};
+                std::vector<Core::NCE::InstructionPatch> tls_patches;
+                std::span<const u32> instructions;
+                u64 patch_address = 0;
+                for (const s64 offset : offsets) {
+                    instructions = patch.RelocateRuntimeTls(offset, tls_patches);
+                    if (instructions.empty()) {continue;}
+                    const u64 address = static_cast<u64>(static_cast<s64>(nro_info->base_address) + offset);
+                    if (R_FAILED(patch_memory->Map(*process, address, patch_size, permission))) {continue;}
+                    patch_address = address;
+                    break;
+                }
+                R_UNLESS(patch_address != 0, RO::ResultOutOfAddressSpace);
+                const Result add_shared_memory_result = process->AddSharedMemory(kernel, patch_memory, patch_address, patch_size);
+                if (R_FAILED(add_shared_memory_result)) {
+                    R_ASSERT(patch_memory->Unmap(*process, patch_address, patch_size));
+                }
+                R_TRY(add_shared_memory_result);
+                std::memcpy(patch_memory->GetPointer(), instructions.data(), instructions.size_bytes());
+                auto* ptr = reinterpret_cast<char*>(patch_address);
+                __builtin___clear_cache(ptr, ptr + instructions.size_bytes());
+                for (const auto& instruction : tls_patches) {
+                    const u64 address = nro_info->base_address + instruction.offset;
+                    memory.Write32(address, instruction.replacement);
+                    ptr = reinterpret_cast<char*>(address);
+                    __builtin___clear_cache(ptr, ptr + sizeof(u32));
+                }
             }
         }
 #endif
-        // Set NRO perms.
-        R_TRY(SetNroPerms(context->GetProcess(), nro_info->base_address, rx_size, ro_size,
-                          rw_size + bss_size));
 
         context->SetNroInfoInUse(nro_info, true);
         nro_info->code_size = rx_size + ro_size;

src/qt_common/config/shared_translation.cpp

@@ -198,10 +198,6 @@ std::unique_ptr<TranslationMap> InitializeTranslations(QObject* parent) {
            tr("GPU Readback Before NCE Invalidation"),
            tr("Flushes GPU buffer data back to guest memory before NCE invalidates the whole "
               "guest page, preserving it while the CPU store proceeds."));
-    INSERT(Settings, nce_runtime_nro_patch,
-           tr("Patch Runtime NROs for NCE"),
-           tr("Applies NCE code patches to runtime-loaded NRO modules."
-              "This is required for some games to run correctly."));
     INSERT(Settings, vsync_mode, tr("VSync Mode:"),
            tr("FIFO (VSync) does not drop frames or exhibit tearing but is limited by the screen "
               "refresh rate.\nFIFO Relaxed allows tearing as it recovers from a slow down.\n"

src/video_core/renderer_vulkan/vk_query_cache.cpp

@@ -952,8 +952,6 @@ private:
         }
         has_flushed_end_pending = false;
 
-        // Refresh buffer state before ending transform feedback to ensure counters_count is up-to-date.
-        UpdateBuffers();
         if (buffers_count == 0) {
             LOG_DEBUG(Render_Vulkan, "EndTransformFeedbackEXT called with no counters (buffers_count=0)");
             scheduler.Record([](vk::CommandBuffer cmdbuf) {

src/video_core/vulkan_common/vulkan_wrapper.cpp

@@ -460,20 +460,8 @@ Instance Instance::Create(u32 version, Span<const char*> layers, Span<const char
 #else
     constexpr VkFlags ci_flags{};
 #endif
-    // DO NOT TOUCH OR CHANGE THE ENGINE NAME/APPLICATION NAME, breaks RNDA3!!
-    // AMD drivers have fixes for Yuzu
-    // if remove => gloom + yellow line glitch appears
-#ifdef __ANDROID__
-    const VkApplicationInfo application_info{
-        .sType = VK_STRUCTURE_TYPE_APPLICATION_INFO,
-        .pNext = nullptr,
-        .pApplicationName = "PUBGMobile",
-        .applicationVersion = VK_MAKE_VERSION(1, 7, 0),
-        .pEngineName = "UnrealEngine",
-        .engineVersion = VK_MAKE_VERSION(4, 23, 0),
-        .apiVersion = VK_API_VERSION_1_3,
-    };
-#else
+    // DO NOT TOUCH, breaks RNDA3!!
+	// Don't know why, but gloom + yellow line glitch appears
     const VkApplicationInfo application_info{
         .sType = VK_STRUCTURE_TYPE_APPLICATION_INFO,
         .pNext = nullptr,
@@ -483,7 +471,6 @@ Instance Instance::Create(u32 version, Span<const char*> layers, Span<const char
         .engineVersion = VK_MAKE_VERSION(1, 3, 0),
         .apiVersion = VK_API_VERSION_1_3,
     };
-#endif
     const VkInstanceCreateInfo ci{
         .sType = VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO,
         .pNext = nullptr,