[pthread] Fix cond-var lock inversion and POSIX timedwait ABI (upstream #113) (#115)

Two follow-ups to upstream #102's condition-variable changes, as analyzed
in upstream issue #113:

- The pending-signal consume path reacquired the guest mutex while still
  holding the condition state lock, inverting lock order against
  cond-signal (mutex -> SyncRoot) and deadlocking both threads. Leave the
  condition lock before relocking, matching the normal wake path.
  This unfroze Dreaming Sarah (PPSA02929) at its title screen.

- pthread_cond_timedwait's third argument is a pointer to an absolute
  CLOCK_REALTIME timespec, not a relative microsecond count; the guest
  address was being truncated into a duration, yielding arbitrary
  timeouts. Read the timespec and convert to a relative wait.
  scePthreadCondTimedwait keeps its separate relative-time ABI.

CONTRIBUTING.md

@@ -1,3 +1,8 @@
+<!--
+Copyright (C) 2026 SharpEmu Emulator Project
+SPDX-License-Identifier: GPL-2.0-or-later
+-->
+
 # Contributing
 
 Contributions are always welcome!

src/SharpEmu.CLI/Program.cs

@@ -8,12 +8,15 @@ using SharpEmu.HLE;
 using SharpEmu.Logging;
 using System.Runtime.InteropServices;
 using System.Text;
+using System.Text.Json;
 
 namespace SharpEmu.CLI;
 
 internal static partial class Program
 {
     private static readonly SharpEmuLogger Log = SharpEmuLog.For("SharpEmu.CLI");
+    private static readonly object ConsoleMirrorSync = new();
+    private static StreamWriter? _consoleMirrorFile;
     private const int DefaultImportTraceLimit = 32;
     private const string MitigatedChildFlag = "--sharpemu-mitigated-child";
     private const uint EXTENDED_STARTUPINFO_PRESENT = 0x00080000;
@@ -21,11 +24,15 @@ internal static partial class Program
     private const int PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY = 0x00020007;
     private const uint JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x00002000;
     private const int JobObjectExtendedLimitInformation = 9;
+    private const int STARTF_USESTDHANDLES = 0x00000100;
+    private const uint HANDLE_FLAG_INHERIT = 0x00000001;
+    private const string MitigatedChildEnvironment = "SHARPEMU_MITIGATED_CHILD";
     private const ulong PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF = 0x00000002UL << 40;
     private const ulong PROCESS_CREATION_MITIGATION_POLICY2_CET_USER_SHADOW_STACKS_ALWAYS_OFF = 0x00000002UL << 28;
     private const ulong PROCESS_CREATION_MITIGATION_POLICY2_USER_CET_SET_CONTEXT_IP_VALIDATION_ALWAYS_OFF = 0x00000002UL << 32;
     private const ulong PROCESS_CREATION_MITIGATION_POLICY2_XTENDED_CONTROL_FLOW_GUARD_ALWAYS_OFF = 0x00000002UL << 40;
     private const int ATTACH_PARENT_PROCESS = -1;
+    private const int STD_INPUT_HANDLE = -10;
     private const int STD_OUTPUT_HANDLE = -11;
     private const int STD_ERROR_HANDLE = -12;
     private const uint GENERIC_READ = 0x80000000;
@@ -43,6 +50,7 @@ internal static partial class Program
         }
         finally
         {
+            DropConsoleFileMirror();
             SharpEmuLog.Shutdown();
         }
     }
@@ -61,6 +69,10 @@ internal static partial class Program
         // itself to a console before the first write.
         EnsureCliConsole();
         UseUtf8ConsoleOutput();
+        if (isMitigatedChild && TryGetLogFileArgument(args, out var earlyLogFilePath))
+        {
+            TryEnableConsoleFileMirror(earlyLogFilePath);
+        }
 
         Console.Error.WriteLine($"[DEBUG] SharpEmu starting with {args.Length} args");
 
@@ -69,12 +81,17 @@ internal static partial class Program
             return childExitCode;
         }
 
-        if (!TryParseArguments(args, out var ebootPath, out var runtimeOptions, out var logLevel))
+        if (!TryParseArguments(args, out var ebootPath, out var runtimeOptions, out var logLevel, out var logFilePath))
         {
             PrintUsage();
             return 1;
         }
 
+        if (!isMitigatedChild && !string.IsNullOrWhiteSpace(logFilePath))
+        {
+            TryEnableConsoleFileMirror(logFilePath);
+        }
+
         SharpEmuLog.MinimumLevel = logLevel;
 
         Log.Info(BuildInfo.Banner);
@@ -234,6 +251,10 @@ internal static partial class Program
     private static string[] NormalizeInternalArguments(string[] args, out bool isMitigatedChild)
     {
         isMitigatedChild = false;
+        var trustedMitigatedChild = string.Equals(
+            Environment.GetEnvironmentVariable(MitigatedChildEnvironment),
+            "1",
+            StringComparison.Ordinal);
         if (args.Length == 0)
         {
             return args;
@@ -244,7 +265,7 @@ internal static partial class Program
         {
             if (string.Equals(arg, MitigatedChildFlag, StringComparison.Ordinal))
             {
-                isMitigatedChild = true;
+                isMitigatedChild = trustedMitigatedChild;
                 continue;
             }
 
@@ -283,9 +304,11 @@ internal static partial class Program
         var commandLine = BuildCommandLine(processPath, childArgs);
         var startupInfoEx = new STARTUPINFOEX();
         startupInfoEx.StartupInfo.cb = Marshal.SizeOf<STARTUPINFOEX>();
+        ConfigureInheritedStdHandles(ref startupInfoEx.StartupInfo);
 
         nint attributeList = 0;
         nint mitigationPolicies = 0;
+        var previousChildEnvironment = Environment.GetEnvironmentVariable(MitigatedChildEnvironment);
         try
         {
             nuint attributeListSize = 0;
@@ -293,7 +316,9 @@ internal static partial class Program
             attributeList = Marshal.AllocHGlobal((nint)attributeListSize);
             if (!InitializeProcThreadAttributeList(attributeList, 1, 0, ref attributeListSize))
             {
-                return false;
+                childExitCode = 5;
+                Console.Error.WriteLine($"[ERROR] Failed to initialize mitigation attributes: {Marshal.GetLastWin32Error()}");
+                return true;
             }
 
             startupInfoEx.lpAttributeList = attributeList;
@@ -301,8 +326,7 @@ internal static partial class Program
             var policy1 = PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF;
             var policy2 =
                 PROCESS_CREATION_MITIGATION_POLICY2_CET_USER_SHADOW_STACKS_ALWAYS_OFF |
-                PROCESS_CREATION_MITIGATION_POLICY2_USER_CET_SET_CONTEXT_IP_VALIDATION_ALWAYS_OFF |
-                PROCESS_CREATION_MITIGATION_POLICY2_XTENDED_CONTROL_FLOW_GUARD_ALWAYS_OFF;
+                PROCESS_CREATION_MITIGATION_POLICY2_USER_CET_SET_CONTEXT_IP_VALIDATION_ALWAYS_OFF;
 
             mitigationPolicies = Marshal.AllocHGlobal(sizeof(ulong) * 2);
             Marshal.WriteInt64(mitigationPolicies, unchecked((long)policy1));
@@ -317,24 +341,31 @@ internal static partial class Program
                 0,
                 0))
             {
-                return false;
+                childExitCode = 5;
+                Console.Error.WriteLine($"[ERROR] Failed to apply mitigation attributes: {Marshal.GetLastWin32Error()}");
+                return true;
             }
 
             var cmdLineBuilder = new StringBuilder(commandLine);
             nint jobHandle = 0;
-            if (!CreateProcessW(
+            Environment.SetEnvironmentVariable(MitigatedChildEnvironment, "1");
+            var created = CreateProcessW(
                 processPath,
                 cmdLineBuilder,
                 0,
                 0,
-                false,
+                true,
                 EXTENDED_STARTUPINFO_PRESENT,
                 0,
                 Environment.CurrentDirectory,
                 ref startupInfoEx,
-                out var processInfo))
+                out var processInfo);
+            Environment.SetEnvironmentVariable(MitigatedChildEnvironment, previousChildEnvironment);
+            if (!created)
             {
-                return false;
+                childExitCode = 5;
+                Console.Error.WriteLine($"[ERROR] Failed to launch mitigated child process: {Marshal.GetLastWin32Error()}");
+                return true;
             }
 
             try
@@ -388,6 +419,8 @@ internal static partial class Program
         }
         finally
         {
+            Environment.SetEnvironmentVariable(MitigatedChildEnvironment, previousChildEnvironment);
+
             if (attributeList != 0)
             {
                 DeleteProcThreadAttributeList(attributeList);
@@ -401,6 +434,238 @@ internal static partial class Program
         }
     }
 
+    private static bool TryGetLogFileArgument(IReadOnlyList<string> args, out string path)
+    {
+        for (var i = 0; i < args.Count; i++)
+        {
+            var argument = args[i];
+            if (string.Equals(argument, "--log-file", StringComparison.OrdinalIgnoreCase))
+            {
+                if (i + 1 < args.Count &&
+                    !string.IsNullOrWhiteSpace(args[i + 1]) &&
+                    !args[i + 1].StartsWith("--", StringComparison.Ordinal) &&
+                    ShouldConsumeLogFilePath(args, i + 1))
+                {
+                    path = args[i + 1];
+                    return true;
+                }
+
+                path = BuildDefaultLogFilePath(TryFindEbootPathToken(args));
+                return true;
+            }
+
+            const string logFilePrefix = "--log-file=";
+            if (argument.StartsWith(logFilePrefix, StringComparison.OrdinalIgnoreCase) &&
+                !string.IsNullOrWhiteSpace(argument[logFilePrefix.Length..]))
+            {
+                path = argument[logFilePrefix.Length..];
+                return true;
+            }
+        }
+
+        path = string.Empty;
+        return false;
+    }
+
+    private static string BuildDefaultLogFilePath(string? ebootPath)
+    {
+        var baseDirectory = AppContext.BaseDirectory;
+        var logsDirectory = Path.Combine(baseDirectory, "user", "logs");
+        var name = TryReadTitleId(ebootPath) ?? "UNKNOWN";
+
+        foreach (var invalid in Path.GetInvalidFileNameChars())
+        {
+            name = name.Replace(invalid, '_');
+        }
+
+        return Path.Combine(logsDirectory, $"{name}-{DateTime.Now:yyyyMMdd-HHmmss}.log");
+    }
+
+    private static string? TryReadTitleId(string? ebootPath)
+    {
+        if (string.IsNullOrWhiteSpace(ebootPath))
+        {
+            return null;
+        }
+
+        try
+        {
+            var directory = Path.GetDirectoryName(Path.GetFullPath(ebootPath));
+            if (string.IsNullOrEmpty(directory))
+            {
+                return null;
+            }
+
+            foreach (var paramPath in new[]
+            {
+                Path.Combine(directory, "sce_sys", "param.json"),
+                Path.Combine(directory, "param.json"),
+            })
+            {
+                if (!File.Exists(paramPath))
+                {
+                    continue;
+                }
+
+                using var stream = File.OpenRead(paramPath);
+                using var document = JsonDocument.Parse(stream);
+                if (document.RootElement.TryGetProperty("titleId", out var titleIdElement) &&
+                    titleIdElement.ValueKind == JsonValueKind.String)
+                {
+                    var titleId = titleIdElement.GetString();
+                    if (!string.IsNullOrWhiteSpace(titleId))
+                    {
+                        return titleId.Trim();
+                    }
+                }
+            }
+        }
+        catch
+        {
+            // Logging should never block launch; unknown title ids use a stable fallback.
+        }
+
+        return null;
+    }
+
+    private static string? TryFindEbootPathToken(IReadOnlyList<string> args)
+    {
+        for (var i = args.Count - 1; i >= 0; i--)
+        {
+            var argument = args[i];
+            if (string.IsNullOrWhiteSpace(argument) ||
+                argument.StartsWith("--", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            return argument;
+        }
+
+        return null;
+    }
+
+    private static bool ShouldConsumeLogFilePath(IReadOnlyList<string> args, int candidateIndex)
+    {
+        var candidate = args[candidateIndex];
+        if (LooksLikeLogFilePath(candidate))
+        {
+            return true;
+        }
+
+        for (var i = candidateIndex + 1; i < args.Count; i++)
+        {
+            var argument = args[i];
+            if (!string.IsNullOrWhiteSpace(argument) &&
+                !argument.StartsWith("--", StringComparison.Ordinal))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static bool LooksLikeLogFilePath(string path)
+    {
+        var extension = Path.GetExtension(path);
+        return string.Equals(extension, ".log", StringComparison.OrdinalIgnoreCase) ||
+            string.Equals(extension, ".txt", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static void TryEnableConsoleFileMirror(string path)
+    {
+        lock (ConsoleMirrorSync)
+        {
+            if (_consoleMirrorFile is not null)
+            {
+                return;
+            }
+
+            try
+            {
+                var directory = Path.GetDirectoryName(path);
+                if (!string.IsNullOrEmpty(directory))
+                {
+                    Directory.CreateDirectory(directory);
+                }
+
+                var stream = new FileStream(
+                    path,
+                    FileMode.Create,
+                    FileAccess.Write,
+                    FileShare.ReadWrite,
+                    bufferSize: 4096,
+                    FileOptions.SequentialScan);
+                _consoleMirrorFile = new StreamWriter(stream, new UTF8Encoding(encoderShouldEmitUTF8Identifier: false))
+                {
+                    AutoFlush = true,
+                };
+
+                Console.SetOut(new TeeTextWriter(Console.Out, _consoleMirrorFile));
+                Console.SetError(new TeeTextWriter(Console.Error, _consoleMirrorFile));
+                Console.Error.WriteLine($"[DEBUG] Log file: {Path.GetFullPath(path)}");
+            }
+            catch (Exception ex)
+            {
+                Console.Error.WriteLine($"[WARN] Could not open log file '{path}': {ex.Message}");
+            }
+        }
+    }
+
+    private static void DropConsoleFileMirror()
+    {
+        lock (ConsoleMirrorSync)
+        {
+            try
+            {
+                _consoleMirrorFile?.Flush();
+                _consoleMirrorFile?.Dispose();
+            }
+            catch
+            {
+            }
+
+            _consoleMirrorFile = null;
+        }
+    }
+
+    private static void ConfigureInheritedStdHandles(ref STARTUPINFO startupInfo)
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
+
+        var input = GetStdHandle(STD_INPUT_HANDLE);
+        var output = GetStdHandle(STD_OUTPUT_HANDLE);
+        var error = GetStdHandle(STD_ERROR_HANDLE);
+        if (!IsHandleValid(output) && !IsHandleValid(error))
+        {
+            return;
+        }
+
+        if (IsHandleValid(input))
+        {
+            _ = SetHandleInformation(input, HANDLE_FLAG_INHERIT, HANDLE_FLAG_INHERIT);
+            startupInfo.hStdInput = input;
+        }
+
+        if (IsHandleValid(output))
+        {
+            _ = SetHandleInformation(output, HANDLE_FLAG_INHERIT, HANDLE_FLAG_INHERIT);
+            startupInfo.hStdOutput = output;
+        }
+
+        if (IsHandleValid(error))
+        {
+            _ = SetHandleInformation(error, HANDLE_FLAG_INHERIT, HANDLE_FLAG_INHERIT);
+            startupInfo.hStdError = error;
+        }
+
+        startupInfo.dwFlags |= STARTF_USESTDHANDLES;
+    }
+
     private static string BuildCommandLine(string processPath, IReadOnlyList<string> args)
     {
         var builder = new StringBuilder();
@@ -503,27 +768,30 @@ internal static partial class Program
 
     private static void PrintUsage()
     {
-        Log.Info("Usage: SharpEmu.CLI [--strict] [--trace-imports[=N]] [--cpu-engine=<native>] [--log-level=<level>] <path-to-eboot.bin>");
-        Log.Info(@"Example: SharpEmu.CLI --cpu-engine=native --trace-imports=64 --log-level=debug ""E:\Games\...\eboot.bin""");
+        Log.Info("Usage: SharpEmu.CLI [--strict] [--trace-imports[=N]] [--cpu-engine=<native>] [--log-level=<level>] [--log-file[=<path>]] <path-to-eboot.bin>");
+        Log.Info(@"Example: SharpEmu.CLI --cpu-engine=native --trace-imports=64 --log-level=debug --log-file ""E:\Games\...\eboot.bin""");
     }
 
     private static bool TryParseArguments(
         string[] args,
         out string ebootPath,
         out SharpEmuRuntimeOptions runtimeOptions,
-        out LogLevel logLevel)
+        out LogLevel logLevel,
+        out string? logFilePath)
     {
         if (args.Length == 0)
         {
             ebootPath = string.Empty;
             runtimeOptions = default;
             logLevel = SharpEmuLog.MinimumLevel;
+            logFilePath = null;
             return false;
         }
 
         var strictDynlibResolution = false;
         var importTraceLimit = 0;
         var cpuEngine = CpuExecutionEngine.NativeOnly;
+        logFilePath = null;
         logLevel = SharpEmuLog.MinimumLevel;
         var pathTokens = new List<string>(args.Length);
         for (var i = 0; i < args.Length; i++)
@@ -553,6 +821,7 @@ internal static partial class Program
                 {
                     ebootPath = string.Empty;
                     runtimeOptions = default;
+                    logFilePath = null;
                     return false;
                 }
 
@@ -566,6 +835,7 @@ internal static partial class Program
                 {
                     ebootPath = string.Empty;
                     runtimeOptions = default;
+                    logFilePath = null;
                     return false;
                 }
 
@@ -573,6 +843,23 @@ internal static partial class Program
                 continue;
             }
 
+            if (string.Equals(argument, "--log-file", StringComparison.OrdinalIgnoreCase))
+            {
+                if (i + 1 < args.Length &&
+                    !string.IsNullOrWhiteSpace(args[i + 1]) &&
+                    !args[i + 1].StartsWith("--", StringComparison.Ordinal) &&
+                    ShouldConsumeLogFilePath(args, i + 1))
+                {
+                    logFilePath = args[++i];
+                }
+                else
+                {
+                    logFilePath = BuildDefaultLogFilePath(TryFindEbootPathToken(args));
+                }
+
+                continue;
+            }
+
             const string logLevelPrefix = "--log-level=";
             if (argument.StartsWith(logLevelPrefix, StringComparison.OrdinalIgnoreCase))
             {
@@ -596,6 +883,7 @@ internal static partial class Program
                     ebootPath = string.Empty;
                     runtimeOptions = default;
                     logLevel = SharpEmuLog.MinimumLevel;
+                    logFilePath = null;
                     return false;
                 }
 
@@ -618,11 +906,27 @@ internal static partial class Program
                 continue;
             }
 
+            const string logFilePrefix = "--log-file=";
+            if (argument.StartsWith(logFilePrefix, StringComparison.OrdinalIgnoreCase))
+            {
+                logFilePath = argument[logFilePrefix.Length..];
+                if (string.IsNullOrWhiteSpace(logFilePath))
+                {
+                    ebootPath = string.Empty;
+                    runtimeOptions = default;
+                    logLevel = SharpEmuLog.MinimumLevel;
+                    return false;
+                }
+
+                continue;
+            }
+
             if (argument.StartsWith("--", StringComparison.Ordinal))
             {
                 ebootPath = string.Empty;
                 runtimeOptions = default;
                 logLevel = SharpEmuLog.MinimumLevel;
+                logFilePath = null;
                 return false;
             }
 
@@ -634,6 +938,7 @@ internal static partial class Program
             ebootPath = string.Empty;
             runtimeOptions = default;
             logLevel = SharpEmuLog.MinimumLevel;
+            logFilePath = null;
             return false;
         }
 
@@ -735,6 +1040,56 @@ internal static partial class Program
         public nuint PeakJobMemoryUsed;
     }
 
+    private sealed class TeeTextWriter : TextWriter
+    {
+        private readonly TextWriter _primary;
+        private readonly TextWriter _mirror;
+
+        public TeeTextWriter(TextWriter primary, TextWriter mirror)
+        {
+            _primary = primary;
+            _mirror = mirror;
+        }
+
+        public override Encoding Encoding => _primary.Encoding;
+
+        public override void Write(char value)
+        {
+            lock (ConsoleMirrorSync)
+            {
+                _primary.Write(value);
+                _mirror.Write(value);
+            }
+        }
+
+        public override void Write(string? value)
+        {
+            lock (ConsoleMirrorSync)
+            {
+                _primary.Write(value);
+                _mirror.Write(value);
+            }
+        }
+
+        public override void WriteLine(string? value)
+        {
+            lock (ConsoleMirrorSync)
+            {
+                _primary.WriteLine(value);
+                _mirror.WriteLine(value);
+            }
+        }
+
+        public override void Flush()
+        {
+            lock (ConsoleMirrorSync)
+            {
+                _primary.Flush();
+                _mirror.Flush();
+            }
+        }
+    }
+
     [DllImport("kernel32.dll", SetLastError = true)]
     [return: MarshalAs(UnmanagedType.Bool)]
     private static extern bool InitializeProcThreadAttributeList(
@@ -819,6 +1174,10 @@ internal static partial class Program
     [return: MarshalAs(UnmanagedType.Bool)]
     private static extern bool SetStdHandle(int stdHandle, nint handle);
 
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool SetHandleInformation(nint handle, uint mask, uint flags);
+
     [DllImport("kernel32.dll", EntryPoint = "CreateFileW", SetLastError = true, CharSet = CharSet.Unicode)]
     private static extern nint CreateFileW(
         string fileName,

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Imports.cs

@@ -810,11 +810,14 @@ public sealed partial class DirectExecutionBackend
 			return !_logUsleep;
 		}
 
+		// Only mutex/rwlock *lock* is excluded: it may block a contended acquire, which the
+		// leaf path can't. unlock never blocks and stays here — routing it off the fast path
+		// slows guest spinlocks enough to livelock (Demon's Souls).
 		return nid is
-			"9UK1vLZQft4" or // scePthreadMutexLock
 			"tn3VlD0hG60" or // scePthreadMutexUnlock
-			"7H0iTOciTLo" or // pthread_mutex_lock
 			"2Z+PpY6CaJg" or // pthread_mutex_unlock
+			"EgmLo6EWgso" or // pthread_rwlock_unlock
+			"+L98PIbGttk" or // scePthreadRwlockUnlock
 			"8aI7R7WaOlc" or // sceAmprCommandBufferConstructor
 			"zgXifHT9ErY" or // sceVideoOutIsFlipPending
 			"V++UgBtQhn0" or // sceAgcGetDataPacketPayloadAddress
@@ -888,12 +891,7 @@ public sealed partial class DirectExecutionBackend
 			"6ULAa0fq4jA" or // scePthreadRwlockInit
 			"1471ajPzxh0" or // pthread_rwlock_destroy
 			"BB+kb08Tl9A" or // scePthreadRwlockDestroy
-			"iGjsr1WAtI0" or // pthread_rwlock_rdlock
-			"Ox9i0c7L5w0" or // scePthreadRwlockRdlock
-			"sIlRvQqsN2Y" or // pthread_rwlock_wrlock
-			"mqdNorrB+gI" or // scePthreadRwlockWrlock
-			"EgmLo6EWgso" or // pthread_rwlock_unlock
-			"+L98PIbGttk" or // scePthreadRwlockUnlock
+			// rwlock rd/wr lock removed (can block); init/destroy/unlock stay.
 			"aI+OeCz8xrQ" or // scePthreadSelf
 			"EotR8a3ASf4" or // pthread_self
 			"eoht7mQOCmo" or // scePthreadGetspecific

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.cs

@@ -1992,9 +1992,16 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 		byte* code = (byte*)ptr;
 		int offset = 0;
-		EmitByte(code, ref offset, 0x48); // sub rsp, 0x20
+		// TlsGetValue returns its TLS pointer in RAX. Preserve the guest return value
+		// above the 32-byte Windows shadow space while keeping the call site aligned.
+		EmitByte(code, ref offset, 0x48); // sub rsp, 0x30
 		EmitByte(code, ref offset, 0x83);
 		EmitByte(code, ref offset, 0xEC);
+		EmitByte(code, ref offset, 0x30);
+		EmitByte(code, ref offset, 0x48); // mov [rsp+0x20], rax
+		EmitByte(code, ref offset, 0x89);
+		EmitByte(code, ref offset, 0x44);
+		EmitByte(code, ref offset, 0x24);
 		EmitByte(code, ref offset, 0x20);
 		EmitByte(code, ref offset, 0xB9); // mov ecx, tlsIndex
 		EmitUInt32(code, ref offset, _hostRspSlotTlsIndex);
@@ -2004,13 +2011,21 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		offset += sizeof(ulong);
 		EmitByte(code, ref offset, 0xFF); // call rax
 		EmitByte(code, ref offset, 0xD0);
-		EmitByte(code, ref offset, 0x48); // add rsp, 0x20
+		EmitByte(code, ref offset, 0x49); // mov r11, rax
+		EmitByte(code, ref offset, 0x89);
+		EmitByte(code, ref offset, 0xC3);
+		EmitByte(code, ref offset, 0x48); // mov rax, [rsp+0x20]
+		EmitByte(code, ref offset, 0x8B);
+		EmitByte(code, ref offset, 0x44);
+		EmitByte(code, ref offset, 0x24);
+		EmitByte(code, ref offset, 0x20);
+		EmitByte(code, ref offset, 0x48); // add rsp, 0x30
 		EmitByte(code, ref offset, 0x83);
 		EmitByte(code, ref offset, 0xC4);
-		EmitByte(code, ref offset, 0x20);
-		EmitByte(code, ref offset, 0x48); // mov rsp, [rax]
+		EmitByte(code, ref offset, 0x30);
+		EmitByte(code, ref offset, 0x49); // mov rsp, [r11]
 		EmitByte(code, ref offset, 0x8B);
-		EmitByte(code, ref offset, 0x20);
+		EmitByte(code, ref offset, 0x23);
 		EmitHostNonvolatileXmmRestore(code, ref offset);
 		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5F);
 		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5E);
@@ -2767,11 +2782,10 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		{
 			return;
 		}
-		if (_guestThreadPumpDepth != 0)
+		if (Interlocked.CompareExchange(ref _guestThreadPumpDepth, 1, 0) != 0)
 		{
 			return;
 		}
-		_guestThreadPumpDepth++;
 		try
 		{
 			for (int i = 0; i < 8; i++)
@@ -2817,7 +2831,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		}
 		finally
 		{
-			_guestThreadPumpDepth--;
+			Volatile.Write(ref _guestThreadPumpDepth, 0);
 		}
 	}
 
@@ -2860,9 +2874,18 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			}
 		}
 
-		if (wakeCount != 0 && _logGuestThreads)
+		if (wakeCount != 0)
 		{
-			Console.Error.WriteLine($"[LOADER][INFO] guest_threads.wake key={wakeKey} count={wakeCount}");
+			if (_logGuestThreads)
+			{
+				Console.Error.WriteLine($"[LOADER][INFO] guest_threads.wake key={wakeKey} count={wakeCount}");
+			}
+
+			// Pump or the readied thread waits for an import dispatch that never comes.
+			if (_cpuContext is { } wakeContext)
+			{
+				Pump(wakeContext, "wake");
+			}
 		}
 
 		return wakeCount;
@@ -4407,6 +4430,26 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			return;
 		}
 		_stallWatchdogStop = false;
+
+		// Drives woken threads when every guest thread is parked (nothing dispatches then).
+		var dispatcherThread = new Thread(new ThreadStart(delegate
+		{
+			while (!_stallWatchdogStop)
+			{
+				Thread.Sleep(1);
+				WakeExpiredBlockedGuestThreads();
+				if (Volatile.Read(ref _readyGuestThreadCount) > 0 && _cpuContext is { } dispatchContext)
+				{
+					Pump(dispatchContext, "dispatcher");
+				}
+			}
+		}))
+		{
+			IsBackground = true,
+			Name = "SharpEmu-GuestThreadDispatcher"
+		};
+		dispatcherThread.Start();
+
 		long num = (long)((double)stallWatchdogSeconds * Stopwatch.Frequency);
 		_stallWatchdogThread = new Thread(new ThreadStart(delegate
 		{
@@ -4435,6 +4478,15 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 					MarkExecutionProgress();
 					continue;
 				}
+				if (IsExpectedBlockingImportStall(out var blockingNid, out var blockingName))
+				{
+					Console.Error.WriteLine(
+						$"[LOADER][WARN] No import progress for {stallWatchdogSeconds}s while waiting in {blockingName} ({blockingNid}); continuing.");
+					LogStallWatchdogSnapshot();
+					Console.Error.Flush();
+					MarkExecutionProgress();
+					continue;
+				}
 				if (Interlocked.Exchange(ref _stallWatchdogTriggered, 1) != 0)
 				{
 					continue;
@@ -4470,6 +4522,38 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		return false;
 	}
 
+	// A thread parked in a blocking wait is idle by design, not stalled.
+	private bool IsExpectedBlockingImportStall(out string nid, out string name)
+	{
+		nid = string.Empty;
+		name = string.Empty;
+		var cpuContext = _cpuContext;
+		if (cpuContext is null)
+		{
+			return false;
+		}
+
+		var importAddress = cpuContext.Rip & 0xFFFFFFFFFFFFFFF0uL;
+		foreach (var entry in _importEntries)
+		{
+			if (entry.Address != importAddress)
+			{
+				continue;
+			}
+
+			nid = entry.Nid;
+			name = _moduleManager.TryGetExport(nid, out var export)
+				? $"{export.LibraryName}:{export.Name}"
+				: nid;
+			return nid is
+				"Op8TBGY5KHg" or // pthread_cond_wait
+				"27bAgiJmOh0" or // pthread_cond_timedwait
+				"fzyMKs9kim0";   // sceKernelWaitEqueue
+		}
+
+		return false;
+	}
+
 	private void StopStallWatchdog()
 	{
 		_stallWatchdogStop = true;

src/SharpEmu.Core/Runtime/SharpEmuRuntime.cs

@@ -83,7 +83,6 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
             ImportTraceLimit = Math.Max(0, options.ImportTraceLimit),
         };
         var moduleManager = new ModuleManager();
-        moduleManager.RegisterFromAssembly(typeof(VideoOutExports).Assembly, Generation.Gen4 | Generation.Gen5, Aerolib.Instance);
         moduleManager.RegisterFromAssembly(typeof(KernelExports).Assembly, Generation.Gen4 | Generation.Gen5, Aerolib.Instance);
         moduleManager.Freeze();
 

src/SharpEmu.GUI/EmulatorProcess.cs

@@ -168,8 +168,7 @@ internal sealed class EmulatorProcess : IDisposable
             var policy1 = PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF;
             var policy2 =
                 PROCESS_CREATION_MITIGATION_POLICY2_CET_USER_SHADOW_STACKS_ALWAYS_OFF |
-                PROCESS_CREATION_MITIGATION_POLICY2_USER_CET_SET_CONTEXT_IP_VALIDATION_ALWAYS_OFF |
-                PROCESS_CREATION_MITIGATION_POLICY2_XTENDED_CONTROL_FLOW_GUARD_ALWAYS_OFF;
+                PROCESS_CREATION_MITIGATION_POLICY2_USER_CET_SET_CONTEXT_IP_VALIDATION_ALWAYS_OFF;
 
             mitigationPolicies = Marshal.AllocHGlobal(sizeof(ulong) * 2);
             Marshal.WriteInt64(mitigationPolicies, unchecked((long)policy1));
@@ -200,29 +199,10 @@ internal sealed class EmulatorProcess : IDisposable
                 ref startupInfoEx,
                 out var processInfo);
 
-            if (!created)
-            {
-                // Some mitigation policy bits (e.g. XFG) are not supported on
-                // older Windows builds. Mirror the CLI's behavior and fall back
-                // to launching without the mitigation attribute list.
-                startupInfoEx.lpAttributeList = 0;
-                created = CreateProcessW(
-                    exePath,
-                    new StringBuilder(BuildCommandLine(exePath, arguments)),
-                    0,
-                    0,
-                    true,
-                    CREATE_NO_WINDOW,
-                    0,
-                    currentDirectory,
-                    ref startupInfoEx,
-                    out processInfo);
-            }
-
             if (!created)
             {
                 var error = Marshal.GetLastWin32Error();
-                throw new Win32Exception(error, $"Failed to start '{exePath}' (Win32 error {error}: {new Win32Exception(error).Message}).");
+                throw new Win32Exception(error, $"Failed to start '{exePath}' with CET/CFG mitigation disabled (Win32 error {error}: {new Win32Exception(error).Message}).");
             }
 
             CloseHandle(processInfo.hThread);

src/SharpEmu.GUI/MainWindow.axaml.cs

@@ -1061,13 +1061,11 @@ public partial class MainWindow : Window
             arguments.Add($"--trace-imports={_settings.ImportTraceLimit}");
         }
 
-        arguments.Add(ebootPath);
-
         _consoleLines.Clear();
         ConsoleToggle.IsChecked = true;
 
-        // Mirror everything the console pane shows into a log file for the
-        // duration of the run, regardless of the emulator's log level.
+        // Let the CLI mirror stdout/stderr itself; it sees loader/native
+        // diagnostics before the GUI pipe reader can filter or batch them.
         DropFileLog();
         if (_settings.LogToFile)
         {
@@ -1105,18 +1103,14 @@ public partial class MainWindow : Window
 
             if (!string.IsNullOrEmpty(filePath))
             {
-                try
-                {
-                    _fileLog = new StreamWriter(filePath, append: false);
-                    AppendConsoleLine($"Log file: {filePath}", DimLineBrush);
-                }
-                catch (Exception ex)
-                {
-                    AppendConsoleLine($"Could not open the log file: {ex.Message}", WarningLineBrush);
-                }
+                arguments.Add("--log-file");
+                arguments.Add(filePath);
+                AppendConsoleLine($"Log file: {filePath}", DimLineBrush);
             }
         }
 
+        arguments.Add(ebootPath);
+
         AppendConsoleLine($"$ SharpEmu {string.Join(' ', arguments)}", DimLineBrush);
 
         var emulator = new EmulatorProcess();

src/SharpEmu.HLE/ModuleManager.cs

@@ -3,18 +3,17 @@
 
 using System.Collections.Concurrent;
 using System.Reflection;
-using SharpEmu.Logging;
+using System.Runtime.CompilerServices;
 
 namespace SharpEmu.HLE;
 
 public sealed class ModuleManager : IModuleManager
 {
-    private static readonly SharpEmuLogger Log = SharpEmuLog.For("HLE");
-
     private readonly ConcurrentDictionary<string, Delegate> _dispatchTable = new(StringComparer.Ordinal);
     private readonly ConcurrentDictionary<string, ExportedFunction> _exportTable = new(StringComparer.Ordinal);
     private readonly ConcurrentDictionary<string, ExportedFunction> _exportNameTable = new(StringComparer.Ordinal);
     private readonly object _registrationGate = new();
+    private readonly HashSet<(Assembly Assembly, Generation Generation)> _scannedAssemblies = new();
     private bool _isFrozen;
 
     public int RegisterFromAssembly(Assembly assembly, Generation generation, ISymbolCatalog? symbolCatalog = null)
@@ -28,6 +27,12 @@ public sealed class ModuleManager : IModuleManager
                 throw new InvalidOperationException("Module registration is frozen.");
             }
 
+            // Deduplicated: one assembly is reached through many types.
+            if (!_scannedAssemblies.Add((assembly, generation)))
+            {
+                return 0;
+            }
+
             var registeredCount = 0;
             var instances = new Dictionary<Type, object>();
 
@@ -50,7 +55,7 @@ public sealed class ModuleManager : IModuleManager
                     var handler = CreateHandler(type, method, instances);
                     if (!_dispatchTable.TryAdd(exportInfo.Value.Nid, handler))
                     {
-                        Log.Warning($"Duplicate NID '{exportInfo.Value.Nid}' ({exportInfo.Value.ExportName}) — already registered, skipping.");
+                        Console.Error.WriteLine($"[HLE] Duplicate NID '{exportInfo.Value.Nid}' ({exportInfo.Value.ExportName}) — already registered, skipping.");
                         continue;
                     }
 
@@ -76,8 +81,195 @@ public sealed class ModuleManager : IModuleManager
         {
             _isFrozen = true;
         }
+
+        WarmHleTypeInitializers();
     }
 
+    // A .cctor or first JIT running on a guest thread's hijacked stack fail-fasts the CLR.
+    // Run every HLE type's initializer and JIT its methods here first, on a host thread.
+    private void WarmHleTypeInitializers()
+    {
+        Assembly[] assemblies;
+        lock (_registrationGate)
+        {
+            assemblies = _scannedAssemblies.Select(entry => entry.Assembly).Distinct().ToArray();
+        }
+
+        assemblies = WithGuestReachableDependencies(assemblies);
+        var bclWarmed = WarmFrameworkTypeInitializers();
+
+        var warmed = 0;
+        var failed = 0;
+        var jitted = 0;
+        var jitFailed = 0;
+        foreach (var assembly in assemblies)
+        {
+            Type[] types;
+            try
+            {
+                types = assembly.GetTypes();
+            }
+            catch (ReflectionTypeLoadException ex)
+            {
+                types = ex.Types.Where(t => t is not null).ToArray()!;
+            }
+
+            const BindingFlags allMembers = BindingFlags.Public | BindingFlags.NonPublic |
+                BindingFlags.Instance | BindingFlags.Static | BindingFlags.DeclaredOnly;
+
+            foreach (var type in types)
+            {
+                if (type is null || type.ContainsGenericParameters)
+                {
+                    continue;
+                }
+
+                try
+                {
+                    RuntimeHelpers.RunClassConstructor(type.TypeHandle);
+                    warmed++;
+                }
+                catch
+                {
+                    // A throw here beats a guest-thread fail-fast later; swallow and continue.
+                    failed++;
+                }
+
+                // Force-JIT (not execute) every method so no guest thread compiles one first.
+                MethodBase[] members;
+                try
+                {
+                    members = type.GetConstructors(allMembers)
+                        .Concat<MethodBase>(type.GetMethods(allMembers))
+                        .ToArray();
+                }
+                catch
+                {
+                    continue;
+                }
+
+                foreach (var member in members)
+                {
+                    if (member.ContainsGenericParameters || member.IsAbstract || member.MethodImplementationFlags.HasFlag(MethodImplAttributes.InternalCall))
+                    {
+                        continue;
+                    }
+
+                    try
+                    {
+                        RuntimeHelpers.PrepareMethod(member.MethodHandle);
+                        jitted++;
+                    }
+                    catch
+                    {
+                        jitFailed++;
+                    }
+                }
+            }
+        }
+
+        Console.Error.WriteLine(
+            $"[HLE] Warmed {warmed} type initializers ({failed} threw) + JIT-compiled {jitted} methods ({jitFailed} skipped) across {assemblies.Length} HLE assemblies, plus {bclWarmed} framework type initializers.");
+    }
+
+    // Framework .cctors too (but not JIT — the BCL is too large).
+    private static int WarmFrameworkTypeInitializers()
+    {
+        var warmed = 0;
+        foreach (var assembly in AppDomain.CurrentDomain.GetAssemblies())
+        {
+            var name = assembly.GetName().Name;
+            if (name is null || !IsFrameworkAssembly(name))
+            {
+                continue;
+            }
+
+            Type[] types;
+            try
+            {
+                types = assembly.GetTypes();
+            }
+            catch (ReflectionTypeLoadException ex)
+            {
+                types = ex.Types.Where(t => t is not null).ToArray()!;
+            }
+            catch
+            {
+                continue;
+            }
+
+            foreach (var type in types)
+            {
+                if (type is null || type.ContainsGenericParameters)
+                {
+                    continue;
+                }
+
+                try
+                {
+                    RuntimeHelpers.RunClassConstructor(type.TypeHandle);
+                    warmed++;
+                }
+                catch
+                {
+                }
+            }
+        }
+
+        return warmed;
+    }
+
+    private static bool IsFrameworkAssembly(string assemblyName) =>
+        assemblyName.StartsWith("System", StringComparison.Ordinal) ||
+        string.Equals(assemblyName, "netstandard", StringComparison.Ordinal);
+
+    // Warm the interop assemblies guest threads reach (e.g. Silk.NET via the flip path).
+    private static Assembly[] WithGuestReachableDependencies(Assembly[] scanned)
+    {
+        var result = new Dictionary<string, Assembly>(StringComparer.Ordinal);
+        foreach (var assembly in scanned)
+        {
+            result[assembly.FullName ?? assembly.GetName().Name ?? string.Empty] = assembly;
+        }
+
+        foreach (var assembly in scanned)
+        {
+            AssemblyName[] references;
+            try
+            {
+                references = assembly.GetReferencedAssemblies();
+            }
+            catch
+            {
+                continue;
+            }
+
+            foreach (var reference in references)
+            {
+                var name = reference.Name;
+                if (name is null || !IsGuestReachableInterop(name))
+                {
+                    continue;
+                }
+
+                try
+                {
+                    var loaded = Assembly.Load(reference);
+                    result[loaded.FullName ?? name] = loaded;
+                }
+                catch
+                {
+                }
+            }
+        }
+
+        return result.Values.ToArray();
+    }
+
+    private static bool IsGuestReachableInterop(string assemblyName) =>
+        assemblyName.StartsWith("Silk.NET", StringComparison.Ordinal) ||
+        assemblyName.StartsWith("SharpEmu", StringComparison.Ordinal);
+
     public bool TryGetFunction(string nid, out Delegate function)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(nid);
@@ -109,7 +301,7 @@ public sealed class ModuleManager : IModuleManager
 
         if (!_dispatchTable.TryGetValue(nid, out var function) || !_exportTable.TryGetValue(nid, out var export))
         {
-            Log.Warning($"NID '{nid}' not found in dispatch table.");
+            Console.Error.WriteLine($"[HLE] NID '{nid}' not found in dispatch table.");
             context[CpuRegister.Rax] = unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
             result = OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
             return false;
@@ -117,7 +309,7 @@ public sealed class ModuleManager : IModuleManager
 
         if ((export.Target & context.TargetGeneration) == 0)
         {
-            Log.Warning($"NID '{nid}' ({export.Name}) found but not implemented for generation {context.TargetGeneration} (targets: {export.Target}).");
+            Console.Error.WriteLine($"[HLE] NID '{nid}' ({export.Name}) found but not implemented for generation {context.TargetGeneration} (targets: {export.Target}).");
             context[CpuRegister.Rax] = unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_IMPLEMENTED);
             result = OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_IMPLEMENTED;
             return false;

src/SharpEmu.Libs/Agc/Gen5ShaderTranslator.cs

@@ -621,6 +621,8 @@ internal static class Gen5ShaderTranslator
             0x10 => "SSendmsg",
             0x16 => "STtraceData",
             0x20 => "SInstPrefetch",
+            0x21 => "SClause",
+            0x23 => "SWaitcntDepctr",
             _ => string.Empty,
         };
 
@@ -718,7 +720,7 @@ internal static class Gen5ShaderTranslator
         }
 
         var src0 = word & 0x1FF;
-        sizeDwords = opcode is 0x20 or 0x21 || src0 is 0xF9 or 0xFA or 0xFF ? 2u : 1u;
+        sizeDwords = opcode is 0x20 or 0x21 or 0x2C or 0x2D || src0 is 0xF9 or 0xFA or 0xFF ? 2u : 1u;
         error = string.Empty;
         name = opcode switch
         {
@@ -757,7 +759,9 @@ internal static class Gen5ShaderTranslator
             0x28 => "VAddcU32",
             0x29 => "VSubbU32",
             0x2A => "VSubbrevU32",
-            0x2B => "VLdexpF32",
+            0x2B => "VFmacF32",
+            0x2C => "VFmamkF32",
+            0x2D => "VFmaakF32",
             0x2F => "VCvtPkrtzF16F32",
             0x30 => "VCvtPkU16U32",
             0x31 => "VCvtPkI16I32",
@@ -870,6 +874,7 @@ internal static class Gen5ShaderTranslator
             0x10F => "VMinF32",
             0x110 => "VMaxF32",
             0x11F => "VMacF32",
+            0x12B => "VFmacF32",
             0x12F => "VCvtPkrtzF16F32",
             0x141 => "VMadF32",
             0x143 => "VMadU32U24",
@@ -897,6 +902,7 @@ internal static class Gen5ShaderTranslator
             0x169 => "VMulLoU32",
             0x16A => "VMulHiU32",
             0x16B => "VMulLoI32",
+            0x16C => "VMulHiI32",
             0x360 => "VMadU32U16",
             0x361 => "VMulLoU32",
             0x362 => "VLdexpF32",
@@ -1379,7 +1385,7 @@ internal static class Gen5ShaderTranslator
                         Gen5Operand.Source(word & 0x1FF, literal),
                         Gen5Operand.Vector((word >> 9) & 0xFF),
                     ];
-                    if (opcode == "VMadMkF32" && literal.HasValue)
+                    if (opcode is "VMadMkF32" or "VFmamkF32" && literal.HasValue)
                     {
                         sources =
                         [
@@ -1388,7 +1394,7 @@ internal static class Gen5ShaderTranslator
                             sources[1],
                         ];
                     }
-                    else if (opcode == "VMadAkF32" && literal.HasValue)
+                    else if (opcode is "VMadAkF32" or "VFmaakF32" && literal.HasValue)
                     {
                         sources =
                         [

src/SharpEmu.Libs/Agc/Gen5SpirvTranslator.Alu.cs

@@ -255,6 +255,8 @@ internal static partial class Gen5SpirvTranslator
                 case "VFmaF32":
                 case "VMadMkF32":
                 case "VMadAkF32":
+                case "VFmamkF32":
+                case "VFmaakF32":
                     result = EmitFloatResult(
                         instruction,
                         Ext(
@@ -265,6 +267,7 @@ internal static partial class Gen5SpirvTranslator
                             GetFloatSource(instruction, 2)));
                     break;
                 case "VMacF32":
+                case "VFmacF32":
                 {
                     var addend = Bitcast(_floatType, LoadV(destination));
                     result = EmitFloatResult(
@@ -334,6 +337,7 @@ internal static partial class Gen5SpirvTranslator
                     result = EmitSubtractWithBorrow(instruction, reverse: true);
                     break;
                 case "VMulLoU32":
+                case "VMulLoI32":
                 case "VMulU32U24":
                     result = EmitIntegerBinary(instruction, SpirvOp.IMul);
                     break;
@@ -369,6 +373,29 @@ internal static partial class Gen5SpirvTranslator
                             _module.Constant64(_ulongType, 32)));
                     break;
                 }
+                case "VMulHiI32":
+                {
+                    var wideLeft = _module.AddInstruction(
+                        SpirvOp.SConvert,
+                        _longType,
+                        Bitcast(_intType, GetRawSource(instruction, 0)));
+                    var wideRight = _module.AddInstruction(
+                        SpirvOp.SConvert,
+                        _longType,
+                        Bitcast(_intType, GetRawSource(instruction, 1)));
+                    var product = _module.AddInstruction(
+                        SpirvOp.IMul,
+                        _longType,
+                        wideLeft,
+                        wideRight);
+                    result = _module.AddInstruction(
+                        SpirvOp.UConvert,
+                        _uintType,
+                        ShiftRightLogical64(
+                            Bitcast(_ulongType, product),
+                            _module.Constant64(_ulongType, 32)));
+                    break;
+                }
                 case "VMadU32U24":
                 {
                     var left = BitwiseAnd(
@@ -1109,6 +1136,52 @@ internal static partial class Gen5SpirvTranslator
                                 left,
                                 right);
                             break;
+                        case "SMulHiU32":
+                        {
+                            var wideLeft = _module.AddInstruction(
+                                SpirvOp.UConvert,
+                                _ulongType,
+                                left);
+                            var wideRight = _module.AddInstruction(
+                                SpirvOp.UConvert,
+                                _ulongType,
+                                right);
+                            var product = _module.AddInstruction(
+                                SpirvOp.IMul,
+                                _ulongType,
+                                wideLeft,
+                                wideRight);
+                            result = _module.AddInstruction(
+                                SpirvOp.UConvert,
+                                _uintType,
+                                ShiftRightLogical64(
+                                    product,
+                                    _module.Constant64(_ulongType, 32)));
+                            break;
+                        }
+                        case "SMulHiI32":
+                        {
+                            var wideLeft = _module.AddInstruction(
+                                SpirvOp.SConvert,
+                                _longType,
+                                Bitcast(_intType, left));
+                            var wideRight = _module.AddInstruction(
+                                SpirvOp.SConvert,
+                                _longType,
+                                Bitcast(_intType, right));
+                            var product = _module.AddInstruction(
+                                SpirvOp.IMul,
+                                _longType,
+                                wideLeft,
+                                wideRight);
+                            result = _module.AddInstruction(
+                                SpirvOp.UConvert,
+                                _uintType,
+                                ShiftRightLogical64(
+                                    Bitcast(_ulongType, product),
+                                    _module.Constant64(_ulongType, 32)));
+                            break;
+                        }
                         case "SAndB32":
                             result = BitwiseAnd(left, right);
                             Store(_scc, IsNotZero(result));

src/SharpEmu.Libs/Kernel/KernelPthreadCompatExports.cs

@@ -24,6 +24,8 @@ public static class KernelPthreadCompatExports
 
     private static readonly object _stateGate = new();
     private static readonly ConcurrentDictionary<ulong, PthreadMutexState> _mutexStates = new();
+    private static readonly ConcurrentDictionary<ulong, string> _mutexWakeKeys = new();
+    private static readonly ConcurrentDictionary<ulong, string> _condWakeKeys = new();
     private static readonly Dictionary<ulong, PthreadMutexAttrState> _mutexAttrStates = new();
     private static readonly Dictionary<ulong, PthreadCondState> _condStates = new();
     private static readonly Dictionary<ulong, object> _onceGates = new();
@@ -35,6 +37,13 @@ public static class KernelPthreadCompatExports
         string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_PTHREAD_CONDS"), "1", StringComparison.Ordinal);
     private static readonly HashSet<ulong>? _tracePthreadMutexFilter = ParseTraceAddressFilter(
         Environment.GetEnvironmentVariable("SHARPEMU_LOG_PTHREAD_MUTEX_FILTER"));
+    private static readonly bool _enableMutexLockBlocking =
+        string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_MUTEX_LOCK_BLOCKING"), "1", StringComparison.Ordinal);
+
+    // On the outer class deliberately: a static on the nested state classes gives them a
+    // type initializer that first runs on a guest thread and fail-fasts the CLR.
+    private static long _nextMutexWakeId;
+    private static long _nextCondWakeId;
 
     private sealed class PthreadMutexState
     {
@@ -43,6 +52,10 @@ public static class KernelPthreadCompatExports
         public int RecursionCount { get; set; }
         public int Type { get; set; } = MutexTypeErrorCheck;
         public int Protocol { get; set; }
+
+        // Keyed on state identity, not the resolved address (which can differ between a
+        // lock and its unlock for the same state, stranding the waiter).
+        public string WakeKey { get; } = "pthread_mutex#" + Interlocked.Increment(ref _nextMutexWakeId).ToString("X");
     }
 
     private sealed class PthreadMutexWaiter
@@ -56,6 +69,23 @@ public static class KernelPthreadCompatExports
         public object SyncRoot { get; } = new();
         public ulong SignalEpoch { get; set; }
         public int Waiters { get; set; }
+
+        // See PthreadMutexState.WakeKey.
+        public string WakeKey { get; } = "pthread_cond#" + Interlocked.Increment(ref _nextCondWakeId).ToString("X");
+
+        // A signal with no waiter stays pending; the guest often signals before the wait.
+        public int PendingSignals { get; set; }
+
+        public bool TryConsumePendingSignal()
+        {
+            if (PendingSignals <= 0)
+            {
+                return false;
+            }
+
+            PendingSignals--;
+            return true;
+        }
     }
 
     private readonly record struct PthreadMutexAttrState(int Type, int Protocol);
@@ -112,6 +142,27 @@ public static class KernelPthreadCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "GBUY7ywdULE",
+        ExportName = "scePthreadRename",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadRename(CpuContext ctx)
+    {
+        if (_tracePthreads)
+        {
+            var nameAddress = ctx[CpuRegister.Rsi];
+            var name = nameAddress != 0 &&
+                KernelMemoryCompatExports.TryReadNullTerminatedUtf8(ctx, nameAddress, 64, out var value)
+                    ? value
+                    : "<unreadable>";
+            Console.Error.WriteLine(
+                $"[LOADER][TRACE] pthread.rename thread=0x{ctx[CpuRegister.Rdi]:X16} name=\"{name}\"");
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "EI-5-jlq2dE",
         ExportName = "scePthreadGetthreadid",
@@ -293,6 +344,38 @@ public static class KernelPthreadCompatExports
         LibraryName = "libKernel")]
     public static int PthreadCondTimedwait(CpuContext ctx) => PthreadCondWaitCore(ctx, ctx[CpuRegister.Rdi], ctx[CpuRegister.Rsi], timed: true, timeoutUsec: unchecked((uint)ctx[CpuRegister.Rdx]));
 
+    [SysAbiExport(
+        Nid = "27bAgiJmOh0",
+        ExportName = "pthread_cond_timedwait",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixPthreadCondTimedwait(CpuContext ctx)
+    {
+        // POSIX passes `const struct timespec *abstime` (absolute deadline), not relative microseconds (#113).
+        var abstimeAddress = ctx[CpuRegister.Rdx];
+        if (abstimeAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!ctx.TryReadUInt64(abstimeAddress, out var deadlineSeconds) ||
+            !ctx.TryReadUInt64(abstimeAddress + 8, out var deadlineNanoseconds))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        var nowMicroseconds = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds() * 1000L;
+        var deadlineMicroseconds =
+            deadlineSeconds >= long.MaxValue / 1_000_000UL
+                ? long.MaxValue
+                : (long)(deadlineSeconds * 1_000_000UL + Math.Min(deadlineNanoseconds, 999_999_999UL) / 1000UL);
+        var remainingMicroseconds = deadlineMicroseconds - nowMicroseconds;
+        var timeoutUsec = remainingMicroseconds <= 0
+            ? 1u
+            : (uint)Math.Min(remainingMicroseconds, uint.MaxValue);
+        return PthreadCondWaitCore(ctx, ctx[CpuRegister.Rdi], ctx[CpuRegister.Rsi], timed: true, timeoutUsec: timeoutUsec);
+    }
+
     [SysAbiExport(
         Nid = "kDh-NfxgMtE",
         ExportName = "scePthreadCondSignal",
@@ -327,12 +410,6 @@ public static class KernelPthreadCompatExports
         Target = Generation.Gen4 | Generation.Gen5,
         LibraryName = "libKernel")]
     public static int PosixPthreadCondSignal(CpuContext ctx) => PthreadCondSignalCore(ctx, ctx[CpuRegister.Rdi], broadcast: false);
-    [SysAbiExport(
-        Nid = "27bAgiJmOh0",
-        ExportName = "pthread_cond_timedwait",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libKernel")]
-    public static int PosixPthreadCondTimedwait(CpuContext ctx) => PthreadCondWaitCore(ctx, ctx[CpuRegister.Rdi], ctx[CpuRegister.Rsi], timed: true, timeoutUsec: unchecked((uint)ctx[CpuRegister.Rdx]));
 
     [SysAbiExport(
         Nid = "m5-2bsNfv7s",
@@ -559,42 +636,42 @@ public static class KernelPthreadCompatExports
                         return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY;
                     }
 
-                    // Normal/adaptive mutexes do not report EDEADLK on self-lock.
-                    // Under the current single-host-thread guest execution model,
-                    // treating them as nested ownership keeps init paths moving
-                    // without turning a would-block path into a hard error.
                     state.RecursionCount++;
                     TracePthreadMutex(ctx, "lock", mutexAddress, resolvedAddress, state, currentThreadId, (int)OrbisGen2Result.ORBIS_GEN2_OK);
                     return (int)OrbisGen2Result.ORBIS_GEN2_OK;
                 }
-
-                var ownedResult = tryOnly
-                    ? (int)OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY
-                    : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_DEADLOCK;
-                TracePthreadMutex(ctx, tryOnly ? "trylock" : "lock", mutexAddress, resolvedAddress, state, currentThreadId, ownedResult);
-                return ownedResult;
+                else
+                {
+                    var ownedResult = tryOnly
+                        ? (int)OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY
+                        : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_DEADLOCK;
+                    TracePthreadMutex(ctx, tryOnly ? "trylock" : "lock", mutexAddress, resolvedAddress, state, currentThreadId, ownedResult);
+                    return ownedResult;
+                }
             }
         }
 
         var acquired = state.Semaphore.Wait(0);
         if (!acquired)
         {
-            // Guest-thread blocking for pthread_mutex_lock is currently disabled.
-            // Demon's Souls deadlocks during PS5SyncEvent initialization.
-            /* var waiter = new PthreadMutexWaiter { ThreadId = currentThreadId };
-            if (!tryOnly &&
+            var waiter = new PthreadMutexWaiter { ThreadId = currentThreadId };
+            // Cooperative deschedule on a contended lock corrupts fiber state
+            // (Demon's Souls sceFiberSwitch -> ESRCH). Off by default: fall through to the
+            // synchronous host-thread wait below.
+            if (_enableMutexLockBlocking &&
+                !tryOnly &&
                 GuestThreadExecution.IsGuestThread &&
                 GuestThreadExecution.TryGetCurrentImportCallFrame(out _) &&
                 GuestThreadExecution.RequestCurrentThreadBlock(
                     ctx,
                     "pthread_mutex_lock",
-                    GetMutexWakeKey(resolvedAddress),
+                    state.WakeKey,
                     () => CompleteBlockedMutexLock(ctx, mutexAddress, resolvedAddress, state, waiter),
                     () => TryReserveBlockedMutexLock(ctx, mutexAddress, resolvedAddress, state, waiter)))
             {
                 TracePthreadMutex(ctx, "lock-block", mutexAddress, resolvedAddress, state, currentThreadId, (int)OrbisGen2Result.ORBIS_GEN2_OK);
                 return (int)OrbisGen2Result.ORBIS_GEN2_OK;
-            } */
+            }
 
             if (!tryOnly)
             {
@@ -611,6 +688,7 @@ public static class KernelPthreadCompatExports
 
         lock (state)
         {
+            DetectMutexDoubleOwner(resolvedAddress, state, currentThreadId, "lock");
             state.OwnerThreadId = currentThreadId;
             state.RecursionCount = 1;
         }
@@ -633,16 +711,24 @@ public static class KernelPthreadCompatExports
         }
 
         var currentThreadId = KernelPthreadState.GetCurrentThreadHandle();
+        var lenientOwnership = state.Type is MutexTypeNormal or MutexTypeAdaptiveNp;
+
         var shouldRelease = false;
         lock (state)
         {
             if (state.RecursionCount <= 0)
             {
+                if (lenientOwnership)
+                {
+                    TracePthreadMutex(ctx, "unlock", mutexAddress, resolvedAddress, state, currentThreadId, (int)OrbisGen2Result.ORBIS_GEN2_OK);
+                    return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+                }
+
                 TracePthreadMutex(ctx, "unlock", mutexAddress, resolvedAddress, state, currentThreadId, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
                 return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
             }
 
-            if (requireOwner && state.OwnerThreadId != currentThreadId)
+            if (requireOwner && !lenientOwnership && state.OwnerThreadId != currentThreadId)
             {
                 TracePthreadMutex(ctx, "unlock", mutexAddress, resolvedAddress, state, currentThreadId, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_PERMISSION_DENIED);
                 return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_PERMISSION_DENIED;
@@ -661,12 +747,15 @@ public static class KernelPthreadCompatExports
             try
             {
                 state.Semaphore.Release();
-                _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(GetMutexWakeKey(resolvedAddress), 1);
+                _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(state.WakeKey, 1);
             }
             catch (SemaphoreFullException)
             {
-                TracePthreadMutex(ctx, "unlock", mutexAddress, resolvedAddress, state, currentThreadId, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
-                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+                if (!lenientOwnership)
+                {
+                    TracePthreadMutex(ctx, "unlock", mutexAddress, resolvedAddress, state, currentThreadId, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+                }
             }
         }
 
@@ -1090,20 +1179,28 @@ public static class KernelPthreadCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
-        if (!TryResolveCondState(ctx, condAddress, createIfZero: true, out _, out var state))
+        if (!TryResolveCondState(ctx, condAddress, createIfZero: true, out var resolvedCondAddress, out var state))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
         }
 
         var waitResult = (int)OrbisGen2Result.ORBIS_GEN2_OK;
         var spuriousWake = false;
+        var releasedRecursion = 0;
         lock (state.SyncRoot)
         {
             state.Waiters++;
             var observedEpoch = state.SignalEpoch;
-            TracePthreadCond("wait-enter", condAddress, mutexAddress, state, timed, waitResult);
+            var consumedPendingSignal = state.TryConsumePendingSignal();
+            TracePthreadCond(
+                consumedPendingSignal ? "wait-enter-pending" : "wait-enter",
+                condAddress,
+                mutexAddress,
+                state,
+                timed,
+                waitResult);
 
-            var unlockResult = PthreadMutexUnlockCore(ctx, mutexAddress, requireOwner: true);
+            var unlockResult = PthreadMutexFullUnlockForCondWait(ctx, mutexAddress, out releasedRecursion);
             if (unlockResult != (int)OrbisGen2Result.ORBIS_GEN2_OK)
             {
                 state.Waiters--;
@@ -1111,10 +1208,34 @@ public static class KernelPthreadCompatExports
                 return unlockResult;
             }
 
-            var scheduler = GuestThreadExecution.Scheduler;
-            if (!timed && GuestThreadExecution.RequestCurrentThreadBlock("pthread_cond_wait"))
+            if (consumedPendingSignal)
             {
-                TracePthreadCond("wait-block", condAddress, mutexAddress, state, timed, waitResult);
+                // Leave SyncRoot before relocking the mutex to avoid lock-order inversion with cond-signal (#113).
+                state.Waiters = Math.Max(0, state.Waiters - 1);
+                TracePthreadCond("wait-wake-pending", condAddress, mutexAddress, state, timed, waitResult);
+                Monitor.Exit(state.SyncRoot);
+                try
+                {
+                    var pendingLockResult = PthreadMutexRelockForCondWait(ctx, mutexAddress, releasedRecursion);
+                    return pendingLockResult != (int)OrbisGen2Result.ORBIS_GEN2_OK ? pendingLockResult : waitResult;
+                }
+                finally
+                {
+                    Monitor.Enter(state.SyncRoot);
+                }
+            }
+
+            var scheduler = GuestThreadExecution.Scheduler;
+            if (GuestThreadExecution.IsGuestThread &&
+                GuestThreadExecution.RequestCurrentThreadBlock(
+                    ctx,
+                    timed ? "pthread_cond_timedwait" : "pthread_cond_wait",
+                    state.WakeKey,
+                    () => ResumePthreadCondWait(ctx, condAddress, mutexAddress, state, observedEpoch, timed, releasedRecursion),
+                    () => state.SignalEpoch != observedEpoch,
+                    timed ? GuestThreadExecution.ComputeDeadlineTimestamp(GetCondWaitTimeout(timeoutUsec)) : 0))
+            {
+                TracePthreadCond(timed ? "wait-block-timed" : "wait-block", condAddress, mutexAddress, state, timed, waitResult);
                 return waitResult;
             }
 
@@ -1137,6 +1258,21 @@ public static class KernelPthreadCompatExports
                 {
                     if (!Monitor.Wait(state.SyncRoot, GetCondSpuriousWakeTimeout()))
                     {
+                        if (scheduler is not null && !GuestThreadExecution.IsGuestThread)
+                        {
+                            Monitor.Exit(state.SyncRoot);
+                            try
+                            {
+                                scheduler.Pump(ctx, "pthread_cond_wait");
+                            }
+                            finally
+                            {
+                                Monitor.Enter(state.SyncRoot);
+                            }
+
+                            continue;
+                        }
+
                         spuriousWake = true;
                         break;
                     }
@@ -1163,7 +1299,7 @@ public static class KernelPthreadCompatExports
                 waitResult);
         }
 
-        var lockResult = PthreadMutexLockCore(ctx, mutexAddress, tryOnly: false);
+        var lockResult = PthreadMutexRelockForCondWait(ctx, mutexAddress, releasedRecursion);
         if (lockResult != (int)OrbisGen2Result.ORBIS_GEN2_OK)
         {
             TracePthreadCond("wait-relock-fail", condAddress, mutexAddress, state, timed, lockResult);
@@ -1189,16 +1325,19 @@ public static class KernelPthreadCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
-        if (!TryResolveCondState(ctx, condAddress, createIfZero: true, out _, out var state))
+        if (!TryResolveCondState(ctx, condAddress, createIfZero: true, out var resolvedCondAddress, out var state))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
         }
 
+        var shouldWakeScheduler = false;
         lock (state.SyncRoot)
         {
+            // Advance the epoch even with no waiter registered — it's the wait predicate.
+            state.SignalEpoch++;
             if (state.Waiters > 0)
             {
-                state.SignalEpoch++;
+                shouldWakeScheduler = true;
                 if (broadcast)
                 {
                     Monitor.PulseAll(state.SyncRoot);
@@ -1208,15 +1347,135 @@ public static class KernelPthreadCompatExports
                     Monitor.Pulse(state.SyncRoot);
                 }
             }
+            else
+            {
+                state.PendingSignals++;
+            }
 
             TracePthreadCond(broadcast ? "broadcast" : "signal", condAddress, mutexAddress: 0, state, timed: false, (int)OrbisGen2Result.ORBIS_GEN2_OK);
         }
 
+        if (shouldWakeScheduler)
+        {
+            _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(
+                state.WakeKey,
+                broadcast ? int.MaxValue : 1);
+        }
+
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    private static int ResumePthreadCondWait(
+        CpuContext ctx,
+        ulong condAddress,
+        ulong mutexAddress,
+        PthreadCondState state,
+        ulong observedEpoch,
+        bool timed,
+        int releasedRecursion)
+    {
+        var waitResult = (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        lock (state.SyncRoot)
+        {
+            state.Waiters = Math.Max(0, state.Waiters - 1);
+            if (timed && state.SignalEpoch == observedEpoch)
+            {
+                waitResult = (int)OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT;
+            }
+
+            TracePthreadCond(
+                waitResult == (int)OrbisGen2Result.ORBIS_GEN2_OK ? "wait-resume" : "wait-resume-timeout",
+                condAddress,
+                mutexAddress,
+                state,
+                timed,
+                waitResult);
+        }
+
+        var lockResult = PthreadMutexRelockForCondWait(ctx, mutexAddress, releasedRecursion);
+        return lockResult == (int)OrbisGen2Result.ORBIS_GEN2_OK ? waitResult : lockResult;
+    }
+
+    private static string GetCondWakeKey(ulong resolvedCondAddress) =>
+        _condWakeKeys.GetOrAdd(resolvedCondAddress, static address => string.Create(
+            31,
+            address,
+            static (destination, value) =>
+            {
+                "pthread_cond:0x".AsSpan().CopyTo(destination);
+                _ = value.TryFormat(destination[15..], out _, "X16");
+            }));
+
+    private static int PthreadMutexFullUnlockForCondWait(CpuContext ctx, ulong mutexAddress, out int releasedRecursion)
+    {
+        releasedRecursion = 0;
+        if (!TryResolveMutexState(ctx, mutexAddress, createIfZero: false, out _, out var state))
+        {
+            return PthreadMutexUnlockCore(ctx, mutexAddress, requireOwner: true);
+        }
+
+        var currentThreadId = KernelPthreadState.GetCurrentThreadHandle();
+        lock (state)
+        {
+            if (state.RecursionCount <= 0 || state.OwnerThreadId != currentThreadId)
+            {
+                return PthreadMutexUnlockCore(ctx, mutexAddress, requireOwner: true);
+            }
+
+            releasedRecursion = state.RecursionCount;
+            state.RecursionCount = 1;
+        }
+
+        return PthreadMutexUnlockCore(ctx, mutexAddress, requireOwner: true);
+    }
+
+    private static int PthreadMutexRelockForCondWait(CpuContext ctx, ulong mutexAddress, int releasedRecursion)
+    {
+        var result = PthreadMutexLockCore(ctx, mutexAddress, tryOnly: false);
+        if (result != (int)OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            return result;
+        }
+
+        if (releasedRecursion > 1 &&
+            TryResolveMutexState(ctx, mutexAddress, createIfZero: false, out _, out var state))
+        {
+            lock (state)
+            {
+                if (state.OwnerThreadId == KernelPthreadState.GetCurrentThreadHandle())
+                {
+                    state.RecursionCount = releasedRecursion;
+                }
+            }
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    public static string? DumpMutexStateForStall(ulong mutexAddress)
+    {
+        if (!_mutexStates.TryGetValue(mutexAddress, out var state))
+        {
+            return null;
+        }
+
+        var waiterThreads = string.Join(",", _mutexStates
+            .Where(pair => ReferenceEquals(pair.Value, state))
+            .Select(pair => $"0x{pair.Key:X}"));
+
+        return $"mutex=0x{mutexAddress:X16} owner=0x{state.OwnerThreadId:X} recursion={state.RecursionCount} " +
+               $"type={state.Type} semaphore_count={state.Semaphore.CurrentCount} aliases=[{waiterThreads}]";
+    }
+
     private static string GetMutexWakeKey(ulong resolvedMutexAddress) =>
-        $"pthread_mutex:0x{resolvedMutexAddress:X16}";
+        _mutexWakeKeys.GetOrAdd(resolvedMutexAddress, static address => string.Create(
+            32,
+            address,
+            static (destination, value) =>
+            {
+                "pthread_mutex:0x".AsSpan().CopyTo(destination);
+                _ = value.TryFormat(destination[16..], out _, "X16");
+            }));
 
     private static bool TryReserveBlockedMutexLock(
         CpuContext ctx,
@@ -1233,6 +1492,13 @@ public static class KernelPthreadCompatExports
                 return false;
             }
 
+            if (!state.Semaphore.Wait(0))
+            {
+                TracePthreadMutex(ctx, "lock-reserve-busy", mutexAddress, resolvedAddress, state, waiter.ThreadId, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY);
+                return false;
+            }
+
+            DetectMutexDoubleOwner(resolvedAddress, state, waiter.ThreadId, "reserve");
             state.OwnerThreadId = waiter.ThreadId;
             state.RecursionCount = 1;
             Interlocked.Exchange(ref waiter.Reserved, 1);
@@ -1264,6 +1530,7 @@ public static class KernelPthreadCompatExports
 
         lock (state)
         {
+            DetectMutexDoubleOwner(resolvedAddress, state, currentThreadId, "resume");
             state.OwnerThreadId = currentThreadId;
             state.RecursionCount = 1;
         }
@@ -1272,6 +1539,19 @@ public static class KernelPthreadCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    // A nonzero foreign prior owner means two guest threads are in the same critical
+    // section. Call while holding lock(state).
+    private static void DetectMutexDoubleOwner(ulong resolvedAddress, PthreadMutexState state, ulong currentThreadId, string site)
+    {
+        var priorOwner = state.OwnerThreadId;
+        if (priorOwner != 0 && priorOwner != currentThreadId)
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][ERROR] MUTEX DOUBLE-OWNER at {site}: resolved=0x{resolvedAddress:X} acquirer=0x{currentThreadId:X} " +
+                $"prior_owner=0x{priorOwner:X} recursion={state.RecursionCount} type={state.Type} sem_count={state.Semaphore.CurrentCount}");
+        }
+    }
+
     private static TimeSpan GetCondWaitTimeout(uint timeoutUsec)
     {
         if (timeoutUsec == 0)
@@ -1409,7 +1689,8 @@ public static class KernelPthreadCompatExports
             $"[LOADER][TRACE] pthread_{operation}: mutex=0x{mutexAddress:X16} resolved=0x{resolvedAddress:X16} " +
             $"guest[0]=0x{guestWord0:X16} guest[8]=0x{guestWord1:X16} " +
             $"current=0x{currentThreadId:X16} owner=0x{(state?.OwnerThreadId ?? 0):X16} " +
-            $"recursion={(state?.RecursionCount ?? 0)} type={(state?.Type ?? 0)} result=0x{unchecked((uint)result):X8}");
+            $"recursion={(state?.RecursionCount ?? 0)} type={(state?.Type ?? 0)} result=0x{unchecked((uint)result):X8} " +
+            $"guest_thread=0x{GuestThreadExecution.CurrentGuestThreadHandle:X16} managed={Environment.CurrentManagedThreadId}");
     }
 
     private static void TracePthreadCond(string operation, ulong condAddress, ulong mutexAddress, PthreadCondState? state, bool timed, int result)

src/SharpEmu.Libs/Kernel/KernelPthreadExtendedCompatExports.cs

@@ -31,6 +31,8 @@ public static class KernelPthreadExtendedCompatExports
     private static long _nextSyntheticRwlockHandleId = 1;
     private static long _nextSyntheticPthreadAttrHandleId = 1;
     private static long _nextSyntheticRwlockAttrHandleId = 1;
+    private static readonly bool _strictRwlockWriterPreference =
+        string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_STRICT_RWLOCK_WRITER_PREFERENCE"), "1", StringComparison.Ordinal);
 
     private static readonly ConcurrentDictionary<ulong, ConcurrentDictionary<int, ulong>> _threadLocalSpecific = new();
 
@@ -85,14 +87,23 @@ public static class KernelPthreadExtendedCompatExports
         public PthreadAttrState Attributes { get; set; } = PthreadAttrState.Default;
     }
 
+    // On the outer class deliberately: a static on the nested state class gives it a type
+    // initializer that first runs on a guest thread and fail-fasts the CLR.
+    private static long _nextRwlockWakeId;
+
     private sealed class PthreadRwlockState
     {
         public object SyncRoot { get; } = new();
         public Dictionary<ulong, int> ReaderCounts { get; } = new();
+        public Dictionary<ulong, int> CompatWriterCounts { get; } = new();
         public int ReaderTotalCount { get; set; }
+        public int CompatWriterTotalCount { get; set; }
         public ulong WriterThreadId { get; set; }
         public int WaitingWriters { get; set; }
 
+        // See PthreadMutexState.WakeKey.
+        public string WakeKey { get; } = "pthread_rwlock#" + Interlocked.Increment(ref _nextRwlockWakeId).ToString("X");
+
         public int GetReaderCount(ulong threadId)
         {
             return ReaderCounts.TryGetValue(threadId, out var count) ? count : 0;
@@ -105,6 +116,33 @@ public static class KernelPthreadExtendedCompatExports
             ReaderTotalCount++;
         }
 
+        public void AddCompatWriter(ulong threadId)
+        {
+            CompatWriterCounts.TryGetValue(threadId, out var currentCount);
+            CompatWriterCounts[threadId] = currentCount + 1;
+            CompatWriterTotalCount++;
+        }
+
+        public bool RemoveCompatWriter(ulong threadId)
+        {
+            if (!CompatWriterCounts.TryGetValue(threadId, out var currentCount) || currentCount <= 0)
+            {
+                return false;
+            }
+
+            if (currentCount == 1)
+            {
+                CompatWriterCounts.Remove(threadId);
+            }
+            else
+            {
+                CompatWriterCounts[threadId] = currentCount - 1;
+            }
+
+            CompatWriterTotalCount = Math.Max(0, CompatWriterTotalCount - 1);
+            return true;
+        }
+
         public bool RemoveReader(ulong threadId)
         {
             if (!ReaderCounts.TryGetValue(threadId, out var currentCount) || currentCount <= 0)
@@ -935,7 +973,7 @@ public static class KernelPthreadExtendedCompatExports
 
         lock (state.SyncRoot)
         {
-            if (state.WriterThreadId != 0 || state.ReaderTotalCount != 0 || state.WaitingWriters != 0)
+            if (state.WriterThreadId != 0 || state.ReaderTotalCount != 0 || state.WaitingWriters != 0 || state.CompatWriterTotalCount != 0)
             {
                 return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY;
             }
@@ -1003,7 +1041,7 @@ public static class KernelPthreadExtendedCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
-        if (!TryResolveRwlockState(ctx, rwlockAddress, createIfZero: false, out _, out var rwlock))
+        if (!TryResolveRwlockState(ctx, rwlockAddress, createIfZero: false, out var resolvedAddress, out var rwlock))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
         }
@@ -1014,7 +1052,11 @@ public static class KernelPthreadExtendedCompatExports
         {
             lock (rwlock.SyncRoot)
             {
-                if (rwlock.WriterThreadId == currentThreadId)
+                if (rwlock.RemoveCompatWriter(currentThreadId))
+                {
+                    Monitor.PulseAll(rwlock.SyncRoot);
+                }
+                else if (rwlock.WriterThreadId == currentThreadId)
                 {
                     rwlock.WriterThreadId = 0;
                     Monitor.PulseAll(rwlock.SyncRoot);
@@ -1037,6 +1079,7 @@ public static class KernelPthreadExtendedCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_PERMISSION_DENIED;
         }
 
+        _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(rwlock.WakeKey);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
@@ -1227,7 +1270,7 @@ public static class KernelPthreadExtendedCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
-        if (!TryResolveRwlockState(ctx, rwlockAddress, createIfZero: true, out _, out var rwlock))
+        if (!TryResolveRwlockState(ctx, rwlockAddress, createIfZero: true, out var resolvedAddress, out var rwlock))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
         }
@@ -1242,20 +1285,60 @@ public static class KernelPthreadExtendedCompatExports
                     return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_DEADLOCK;
                 }
 
+                if (rwlock.CompatWriterCounts.GetValueOrDefault(currentThreadId) > 0)
+                {
+                    rwlock.AddCompatWriter(currentThreadId);
+                    return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+                }
+
+                if (GuestThreadExecution.IsGuestThread &&
+                    !_strictRwlockWriterPreference &&
+                    rwlock.WriterThreadId == 0 &&
+                    rwlock.ReaderTotalCount == 0 &&
+                    rwlock.CompatWriterTotalCount == 0)
+                {
+                    rwlock.AddCompatWriter(currentThreadId);
+                    return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+                }
+
+                if (rwlock.WriterThreadId == 0 && rwlock.ReaderTotalCount == 0 && rwlock.CompatWriterTotalCount == 0)
+                {
+                    DetectRwlockWriterConflict(resolvedAddress, rwlock, currentThreadId, "wrlock");
+                    rwlock.WriterThreadId = currentThreadId;
+                    return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+                }
+
                 rwlock.WaitingWriters++;
+                var transferredToScheduler = false;
                 try
                 {
-                    while (rwlock.WriterThreadId != 0 || rwlock.ReaderTotalCount != 0)
+                    if (GuestThreadExecution.IsGuestThread &&
+                        GuestThreadExecution.TryGetCurrentImportCallFrame(out _) &&
+                        GuestThreadExecution.RequestCurrentThreadBlock(
+                            ctx,
+                            "pthread_rwlock_wrlock",
+                            rwlock.WakeKey,
+                            static () => (int)OrbisGen2Result.ORBIS_GEN2_OK,
+                            () => TryAcquireBlockedRwlock(rwlock, currentThreadId, write: true)))
+                    {
+                        transferredToScheduler = true;
+                        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+                    }
+
+                    while (rwlock.WriterThreadId != 0 || rwlock.ReaderTotalCount != 0 || rwlock.CompatWriterTotalCount != 0)
                     {
                         Monitor.Wait(rwlock.SyncRoot);
                     }
+
+                    rwlock.WriterThreadId = currentThreadId;
                 }
                 finally
                 {
-                    rwlock.WaitingWriters--;
+                    if (!transferredToScheduler)
+                    {
+                        rwlock.WaitingWriters = Math.Max(0, rwlock.WaitingWriters - 1);
+                    }
                 }
-
-                rwlock.WriterThreadId = currentThreadId;
             }
             else
             {
@@ -1264,12 +1347,30 @@ public static class KernelPthreadExtendedCompatExports
                     return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_DEADLOCK;
                 }
 
-                while (rwlock.WriterThreadId != 0 ||
-                       (rwlock.WaitingWriters > 0 && rwlock.GetReaderCount(currentThreadId) == 0))
+                while (ReaderMustWaitForRwlock(rwlock, currentThreadId))
                 {
+                    if (GuestThreadExecution.IsGuestThread &&
+                        GuestThreadExecution.TryGetCurrentImportCallFrame(out _) &&
+                        GuestThreadExecution.RequestCurrentThreadBlock(
+                            ctx,
+                            "pthread_rwlock_rdlock",
+                            rwlock.WakeKey,
+                            static () => (int)OrbisGen2Result.ORBIS_GEN2_OK,
+                            () => TryAcquireBlockedRwlock(rwlock, currentThreadId, write: false)))
+                    {
+                        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+                    }
+
                     Monitor.Wait(rwlock.SyncRoot);
                 }
 
+                if (rwlock.WriterThreadId != 0 ||
+                    rwlock.CompatWriterTotalCount > rwlock.CompatWriterCounts.GetValueOrDefault(currentThreadId))
+                {
+                    Console.Error.WriteLine(
+                        $"[LOADER][ERROR] RWLOCK READER/WRITER COEXIST: resolved=0x{resolvedAddress:X} reader=0x{currentThreadId:X} " +
+                        $"writer=0x{rwlock.WriterThreadId:X} compat_total={rwlock.CompatWriterTotalCount} readers_total={rwlock.ReaderTotalCount}");
+                }
                 rwlock.AddReader(currentThreadId);
             }
         }
@@ -1277,6 +1378,86 @@ public static class KernelPthreadExtendedCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    private static bool TryAcquireBlockedRwlock(PthreadRwlockState rwlock, ulong currentThreadId, bool write)
+    {
+        lock (rwlock.SyncRoot)
+        {
+            if (write)
+            {
+                if (rwlock.WriterThreadId != 0 || rwlock.ReaderTotalCount != 0 || rwlock.CompatWriterTotalCount != 0)
+                {
+                    return false;
+                }
+
+                DetectRwlockWriterConflict(0, rwlock, currentThreadId, "wrlock-resume");
+                rwlock.WriterThreadId = currentThreadId;
+                rwlock.WaitingWriters = Math.Max(0, rwlock.WaitingWriters - 1);
+                return true;
+            }
+
+            if (ReaderMustWaitForRwlock(rwlock, currentThreadId))
+            {
+                return false;
+            }
+
+            rwlock.AddReader(currentThreadId);
+            return true;
+        }
+    }
+
+    // Call while holding lock(rwlock.SyncRoot): an existing reader/writer here means a
+    // writer would share the rwlock with another holder — a data race.
+    private static void DetectRwlockWriterConflict(ulong resolvedAddress, PthreadRwlockState rwlock, ulong currentThreadId, string site)
+    {
+        if (rwlock.WriterThreadId != 0 ||
+            rwlock.ReaderTotalCount != 0 ||
+            rwlock.CompatWriterTotalCount > rwlock.CompatWriterCounts.GetValueOrDefault(currentThreadId))
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][ERROR] RWLOCK WRITER CONFLICT at {site}: resolved=0x{resolvedAddress:X} writer=0x{currentThreadId:X} " +
+                $"existing_writer=0x{rwlock.WriterThreadId:X} readers_total={rwlock.ReaderTotalCount} compat_total={rwlock.CompatWriterTotalCount}");
+        }
+    }
+
+    private static bool ReaderMustWaitForRwlock(PthreadRwlockState rwlock, ulong currentThreadId)
+    {
+        if (rwlock.WriterThreadId != 0)
+        {
+            return true;
+        }
+
+        if (rwlock.CompatWriterTotalCount > rwlock.CompatWriterCounts.GetValueOrDefault(currentThreadId))
+        {
+            return true;
+        }
+
+        return rwlock.WaitingWriters > 0 &&
+               rwlock.GetReaderCount(currentThreadId) == 0;
+    }
+
+    private static string GetRwlockWakeKey(ulong rwlockAddress) => $"pthread_rwlock:0x{rwlockAddress:X16}";
+
+    public static string? DumpRwlockStateForStall(ulong rwlockAddress)
+    {
+        PthreadRwlockState? rwlock;
+        lock (_stateGate)
+        {
+            if (!_rwlockStates.TryGetValue(rwlockAddress, out rwlock))
+            {
+                return null;
+            }
+        }
+
+        lock (rwlock.SyncRoot)
+        {
+            var readers = string.Join(",", rwlock.ReaderCounts.Select(pair => $"0x{pair.Key:X}x{pair.Value}"));
+            var compatWriters = string.Join(",", rwlock.CompatWriterCounts.Select(pair => $"0x{pair.Key:X}x{pair.Value}"));
+            return $"rwlock=0x{rwlockAddress:X16} writer=0x{rwlock.WriterThreadId:X} waiting_writers={rwlock.WaitingWriters} " +
+                   $"readers_total={rwlock.ReaderTotalCount} readers=[{readers}] " +
+                   $"compat_writers_total={rwlock.CompatWriterTotalCount} compat_writers=[{compatWriters}]";
+        }
+    }
+
     private static ulong ResolveRwlockHandle(CpuContext ctx, ulong rwlockAddress)
     {
         if (rwlockAddress == 0)

src/SharpEmu.Libs/Rtc/RtcExports.cs

@@ -9,6 +9,189 @@ namespace SharpEmu.Libs.Rtc;
 public static class RtcExports
 {
     private const long DateTimeTicksPerMicrosecond = 10;
+    private const ulong MicrosecondsPerSecond = 1_000_000UL;
+    private const ulong MicrosecondsPerMinute = 60_000_000UL;
+    private const ulong MicrosecondsPerHour = 3_600_000_000UL;
+    private const ulong MicrosecondsPerDay = 86_400_000_000UL;
+    private const ulong MicrosecondsPerWeek = 604_800_000_000UL;
+    private const ulong UnixEpochTicks = 62_135_596_800_000_000UL;
+    private const ulong Win32FileTimeEpochTicks = 50_491_123_200_000_000UL;
+
+    [SysAbiExport(
+        Nid = "lPEBYdVX0XQ",
+        ExportName = "sceRtcCheckValid",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcCheckValid(CpuContext ctx)
+    {
+        var timeAddress = ctx[CpuRegister.Rdi];
+        if (timeAddress == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        if (!TryReadRtcDateTime(ctx, timeAddress, out var time))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        return ValidateRtcDateTime(time);
+    }
+
+    [SysAbiExport(
+        Nid = "fNaZ4DbzHAE",
+        ExportName = "sceRtcCompareTick",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcCompareTick(CpuContext ctx)
+    {
+        var tick1Address = ctx[CpuRegister.Rdi];
+        var tick2Address = ctx[CpuRegister.Rsi];
+        if (tick1Address == 0 || tick2Address == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        if (!ctx.TryReadUInt64(tick1Address, out var tick1) || !ctx.TryReadUInt64(tick2Address, out var tick2))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        return tick1 < tick2 ? -1 : tick1 > tick2 ? 1 : 0;
+    }
+
+    [SysAbiExport(
+        Nid = "8Yr143yEnRo",
+        ExportName = "sceRtcConvertLocalTimeToUtc",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcConvertLocalTimeToUtc(CpuContext ctx)
+    {
+        var tickLocalAddress = ctx[CpuRegister.Rdi];
+        var tickUtcAddress = ctx[CpuRegister.Rsi];
+        if (tickLocalAddress == 0 || tickUtcAddress == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        if (!ctx.TryReadUInt64(tickLocalAddress, out var tickLocal))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (!TryConvertTickToDateTime(tickLocal, out var localDateTime))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        DateTime utcDateTime;
+        try
+        {
+            utcDateTime = TimeZoneInfo.ConvertTimeToUtc(localDateTime, TimeZoneInfo.Local);
+        }
+        catch (ArgumentException)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryWriteTickFromDateTime(ctx, tickUtcAddress, utcDateTime))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "M1TvFst-jrM",
+        ExportName = "sceRtcConvertUtcToLocalTime",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcConvertUtcToLocalTime(CpuContext ctx)
+    {
+        var tickUtcAddress = ctx[CpuRegister.Rdi];
+        var tickLocalAddress = ctx[CpuRegister.Rsi];
+        if (tickUtcAddress == 0 || tickLocalAddress == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        if (!ctx.TryReadUInt64(tickUtcAddress, out var tickUtc))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (!TryConvertTickToDateTime(tickUtc, out var utcDateTime))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        DateTime localDateTime;
+        try
+        {
+            localDateTime = TimeZoneInfo.ConvertTimeFromUtc(utcDateTime, TimeZoneInfo.Local);
+        }
+        catch (ArgumentException)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryWriteTickFromDateTime(ctx, tickLocalAddress, localDateTime))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "8SljQx6pDP8",
+        ExportName = "sceRtcEnd",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcEnd(CpuContext ctx)
+    {
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "LN3Zcb72Q0c",
+        ExportName = "sceRtcGetCurrentAdNetworkTick",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetCurrentAdNetworkTick(CpuContext ctx) => RtcGetCurrentTick(ctx);
+
+    [SysAbiExport(
+        Nid = "8lfvnRMqwEM",
+        ExportName = "sceRtcGetCurrentClock",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetCurrentClock(CpuContext ctx)
+    {
+        var timeAddress = ctx[CpuRegister.Rdi];
+        if (timeAddress == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        var timeZoneMinutes = unchecked((int)ctx[CpuRegister.Rsi]);
+        DateTimeOffset currentTime;
+        try
+        {
+            currentTime = DateTimeOffset.UtcNow.ToOffset(TimeSpan.FromMinutes(timeZoneMinutes));
+        }
+        catch (ArgumentOutOfRangeException)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryWriteRtcDateTime(ctx, timeAddress, ToRtcDateTime(currentTime.DateTime)))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
 
     [SysAbiExport(
         Nid = "ZPD1YOKI+Kw",
@@ -20,30 +203,38 @@ public static class RtcExports
         var timeAddress = ctx[CpuRegister.Rdi];
         if (timeAddress == 0)
         {
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+            return unchecked((int)0x80B50002);
         }
 
-        var now = DateTimeOffset.Now;
-        Span<byte> rtcDateTime = stackalloc byte[16];
-        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[0..2], checked((ushort)now.Year));
-        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[2..4], checked((ushort)now.Month));
-        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[4..6], checked((ushort)now.Day));
-        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[6..8], checked((ushort)now.Hour));
-        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[8..10], checked((ushort)now.Minute));
-        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[10..12], checked((ushort)now.Second));
-        BinaryPrimitives.WriteUInt32LittleEndian(
-            rtcDateTime[12..16],
-            checked((uint)((now.Ticks % TimeSpan.TicksPerSecond) / 10)));
-
-        if (!ctx.Memory.TryWrite(timeAddress, rtcDateTime))
+        if (!TryWriteRtcDateTime(ctx, timeAddress, ToRtcDateTime(DateTimeOffset.Now.DateTime)))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        ctx[CpuRegister.Rax] = 0;
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "Ot1DE3gif84",
+        ExportName = "sceRtcGetCurrentDebugNetworkTick",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetCurrentDebugNetworkTick(CpuContext ctx) => RtcGetCurrentTick(ctx);
+
+    [SysAbiExport(
+        Nid = "zO9UL3qIINQ",
+        ExportName = "sceRtcGetCurrentNetworkTick",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetCurrentNetworkTick(CpuContext ctx) => RtcGetCurrentTick(ctx);
+
+    [SysAbiExport(
+        Nid = "HWxHOdbM-Pg",
+        ExportName = "sceRtcGetCurrentRawNetworkTick",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetCurrentRawNetworkTick(CpuContext ctx) => RtcGetCurrentTick(ctx);
+
     [SysAbiExport(
         Nid = "18B2NS1y9UU",
         ExportName = "sceRtcGetCurrentTick",
@@ -54,7 +245,7 @@ public static class RtcExports
         var tickAddress = ctx[CpuRegister.Rdi];
         if (tickAddress == 0)
         {
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+            return unchecked((int)0x80B50002);
         }
 
         var tickValue = unchecked((ulong)(DateTime.UtcNow.Ticks / DateTimeTicksPerMicrosecond));
@@ -63,7 +254,87 @@ public static class RtcExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "CyIK-i4XdgQ",
+        ExportName = "sceRtcGetDayOfWeek",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetDayOfWeek(CpuContext ctx)
+    {
+        var year = unchecked((int)ctx[CpuRegister.Rdi]);
+        var month = unchecked((int)ctx[CpuRegister.Rsi]);
+        var day = unchecked((int)ctx[CpuRegister.Rdx]);
+        if (!IsValidCalendarDate(year, month, day))
+        {
+            return unchecked((int)0x80B50004);
+        }
+
+        return (int)new DateTime(year, month, day).DayOfWeek;
+    }
+
+    [SysAbiExport(
+        Nid = "3O7Ln8AqJ1o",
+        ExportName = "sceRtcGetDaysInMonth",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetDaysInMonth(CpuContext ctx)
+    {
+        var year = unchecked((int)ctx[CpuRegister.Rdi]);
+        var month = unchecked((int)ctx[CpuRegister.Rsi]);
+        if (year < 1 || year > 9999)
+        {
+            return unchecked((int)0x80B50008);
+        }
+
+        if (month < 1 || month > 12)
+        {
+            return unchecked((int)0x80B50009);
+        }
+
+        return DateTime.DaysInMonth(year, month);
+    }
+
+    [SysAbiExport(
+        Nid = "E7AR4o7Ny7E",
+        ExportName = "sceRtcGetDosTime",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetDosTime(CpuContext ctx)
+    {
+        var timeAddress = ctx[CpuRegister.Rdi];
+        var dosTimeAddress = ctx[CpuRegister.Rsi];
+        if (timeAddress == 0 || dosTimeAddress == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        if (!TryReadRtcDateTime(ctx, timeAddress, out var time))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        var validationResult = ValidateRtcDateTime(time);
+        if (validationResult != (int)OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            return validationResult;
+        }
+
+        uint dosTime = 0;
+        dosTime |= (uint)((time.Second / 2) & 0x1F);
+        dosTime |= (uint)(time.Minute & 0x3F) << 5;
+        dosTime |= (uint)(time.Hour & 0x1F) << 11;
+        dosTime |= (uint)(time.Day & 0x1F) << 16;
+        dosTime |= (uint)(time.Month & 0x0F) << 21;
+        dosTime |= (uint)((time.Year - 1980) & 0x7F) << 25;
+
+        if (!ctx.TryWriteUInt32(dosTimeAddress, dosTime))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
@@ -74,45 +345,220 @@ public static class RtcExports
         LibraryName = "libSceRtc")]
     public static int RtcGetTick(CpuContext ctx)
     {
-        var dateTimeAddress = ctx[CpuRegister.Rdi];
+        var timeAddress = ctx[CpuRegister.Rdi];
         var tickAddress = ctx[CpuRegister.Rsi];
-        if (dateTimeAddress == 0 || tickAddress == 0)
+        if (timeAddress == 0 || tickAddress == 0)
         {
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+            return unchecked((int)0x80B50002);
         }
 
-        if (!TryReadRtcDateTime(ctx, dateTimeAddress, out var rtcDateTime))
+        if (!TryReadRtcDateTime(ctx, timeAddress, out var time))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        ulong tickValue;
-        try
+        var validationResult = ValidateRtcDateTime(time);
+        if (validationResult != (int)OrbisGen2Result.ORBIS_GEN2_OK)
         {
-            var baseDateTime = new DateTime(
-                rtcDateTime.Year,
-                rtcDateTime.Month,
-                rtcDateTime.Day,
-                rtcDateTime.Hour,
-                rtcDateTime.Minute,
-                rtcDateTime.Second,
-                DateTimeKind.Utc);
-            tickValue = checked((ulong)((baseDateTime.Ticks / DateTimeTicksPerMicrosecond) + rtcDateTime.Microsecond));
+            return validationResult;
         }
-        catch (Exception ex) when (ex is ArgumentOutOfRangeException or OverflowException)
+
+        if (!TryConvertRtcDateTimeToTick(time, out var tick))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
-        if (!ctx.TryWriteUInt64(tickAddress, tickValue))
+        if (!ctx.TryWriteUInt64(tickAddress, tick))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        ctx[CpuRegister.Rax] = 0;
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "jMNwqYr4R-k",
+        ExportName = "sceRtcGetTickResolution",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetTickResolution(CpuContext ctx)
+    {
+        return (int)MicrosecondsPerSecond;
+    }
+
+    [SysAbiExport(
+        Nid = "BtqmpTRXHgk",
+        ExportName = "sceRtcGetTime_t",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetTimeT(CpuContext ctx)
+    {
+        var timeAddress = ctx[CpuRegister.Rdi];
+        var timeTAddress = ctx[CpuRegister.Rsi];
+        if (timeAddress == 0 || timeTAddress == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        if (!TryReadRtcDateTime(ctx, timeAddress, out var time))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        var validationResult = ValidateRtcDateTime(time);
+        if (validationResult != (int)OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            return validationResult;
+        }
+
+        if (!TryConvertRtcDateTimeToTick(time, out var tick))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var unixSeconds = tick < UnixEpochTicks ? 0UL : (tick - UnixEpochTicks) / MicrosecondsPerSecond;
+        if (!ctx.TryWriteUInt64(timeTAddress, unixSeconds))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "jfRO0uTjtzA",
+        ExportName = "sceRtcGetWin32FileTime",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetWin32FileTime(CpuContext ctx)
+    {
+        var timeAddress = ctx[CpuRegister.Rdi];
+        var fileTimeAddress = ctx[CpuRegister.Rsi];
+        if (timeAddress == 0 || fileTimeAddress == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        if (!TryReadRtcDateTime(ctx, timeAddress, out var time))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        var validationResult = ValidateRtcDateTime(time);
+        if (validationResult != (int)OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            return validationResult;
+        }
+
+        if (!TryConvertRtcDateTimeToTick(time, out var tick))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var win32Time = tick < Win32FileTimeEpochTicks ? 0UL : (tick - Win32FileTimeEpochTicks) * 10UL;
+        if (!ctx.TryWriteUInt64(fileTimeAddress, win32Time))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "LlodCMDbk3o",
+        ExportName = "sceRtcInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcInit(CpuContext ctx)
+    {
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "Ug8pCwQvh0c",
+        ExportName = "sceRtcIsLeapYear",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcIsLeapYear(CpuContext ctx)
+    {
+        var year = unchecked((int)ctx[CpuRegister.Rdi]);
+        if (year < 1 || year > 9999)
+        {
+            return unchecked((int)0x80B50008);
+        }
+
+        return DateTime.IsLeapYear(year) ? 1 : 0;
+    }
+
+    [SysAbiExport(
+        Nid = "NR1J0N7L2xY",
+        ExportName = "sceRtcTickAddDays",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcTickAddDays(CpuContext ctx) => AddTickDelta(ctx, MicrosecondsPerDay);
+
+    [SysAbiExport(
+        Nid = "MDc5cd8HfCA",
+        ExportName = "sceRtcTickAddHours",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcTickAddHours(CpuContext ctx) => AddTickDelta(ctx, MicrosecondsPerHour);
+
+    [SysAbiExport(
+        Nid = "XPIiw58C+GM",
+        ExportName = "sceRtcTickAddMicroseconds",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcTickAddMicroseconds(CpuContext ctx) => AddTickDelta(ctx, 1UL);
+
+    [SysAbiExport(
+        Nid = "mn-tf4QiFzk",
+        ExportName = "sceRtcTickAddMinutes",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcTickAddMinutes(CpuContext ctx) => AddTickDelta(ctx, MicrosecondsPerMinute);
+
+    [SysAbiExport(
+        Nid = "CL6y9q-XbuQ",
+        ExportName = "sceRtcTickAddMonths",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcTickAddMonths(CpuContext ctx)
+    {
+        return AddCalendarDelta(ctx, dateTime => dateTime.AddMonths(unchecked((int)ctx[CpuRegister.Rdx])));
+    }
+
+    [SysAbiExport(
+        Nid = "07O525HgICs",
+        ExportName = "sceRtcTickAddSeconds",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcTickAddSeconds(CpuContext ctx) => AddTickDelta(ctx, MicrosecondsPerSecond);
+
+    [SysAbiExport(
+        Nid = "AqVMssr52Rc",
+        ExportName = "sceRtcTickAddTicks",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcTickAddTicks(CpuContext ctx) => AddTickDelta(ctx, 1UL);
+
+    [SysAbiExport(
+        Nid = "gI4t194c2W8",
+        ExportName = "sceRtcTickAddWeeks",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcTickAddWeeks(CpuContext ctx) => AddTickDelta(ctx, MicrosecondsPerWeek);
+
+    [SysAbiExport(
+        Nid = "-5y2uJ62qS8",
+        ExportName = "sceRtcTickAddYears",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcTickAddYears(CpuContext ctx)
+    {
+        return AddCalendarDelta(ctx, dateTime => dateTime.AddYears(unchecked((int)ctx[CpuRegister.Rdx])));
+    }
+
     [SysAbiExport(
         Nid = "ueega6v3GUw",
         ExportName = "sceRtcSetTick",
@@ -120,11 +566,11 @@ public static class RtcExports
         LibraryName = "libSceRtc")]
     public static int RtcSetTick(CpuContext ctx)
     {
-        var dateTimeAddress = ctx[CpuRegister.Rdi];
+        var timeAddress = ctx[CpuRegister.Rdi];
         var tickAddress = ctx[CpuRegister.Rsi];
-        if (dateTimeAddress == 0 || tickAddress == 0)
+        if (timeAddress == 0 || tickAddress == 0)
         {
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+            return unchecked((int)0x80B50002);
         }
 
         if (!ctx.TryReadUInt64(tickAddress, out var tickValue))
@@ -132,40 +578,249 @@ public static class RtcExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        if (tickValue > long.MaxValue / DateTimeTicksPerMicrosecond)
+        if (!TryConvertTickToRtcDateTime(tickValue, out var time))
         {
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+            return unchecked((int)0x80B50004);
         }
 
-        DateTime dateTime;
-        try
-        {
-            dateTime = new DateTime(checked((long)tickValue * DateTimeTicksPerMicrosecond), DateTimeKind.Utc);
-        }
-        catch (ArgumentOutOfRangeException)
-        {
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
-        }
-
-        if (!TryWriteRtcDateTime(ctx, dateTimeAddress, dateTime))
+        if (!TryWriteRtcDateTime(ctx, timeAddress, time))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        ctx[CpuRegister.Rax] = 0;
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
-    private static bool TryReadRtcDateTime(CpuContext ctx, ulong address, out RtcDateTime rtcDateTime)
+    [SysAbiExport(
+        Nid = "aYPCd1cChyg",
+        ExportName = "sceRtcSetDosTime",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcSetDosTime(CpuContext ctx)
+    {
+        var timeAddress = ctx[CpuRegister.Rdi];
+        if (timeAddress == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        var dosTime = unchecked((uint)ctx[CpuRegister.Rsi]);
+        var time = new RtcDateTime(
+            (ushort)(1980 + ((dosTime >> 25) & 0x7F)),
+            (ushort)((dosTime >> 21) & 0x0F),
+            (ushort)((dosTime >> 16) & 0x1F),
+            (ushort)((dosTime >> 11) & 0x1F),
+            (ushort)((dosTime >> 5) & 0x3F),
+            (ushort)((dosTime << 1) & 0x3E),
+            0);
+
+        if (!TryWriteRtcDateTime(ctx, timeAddress, time))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "bDEVVP4bTjQ",
+        ExportName = "sceRtcSetTime_t",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcSetTimeT(CpuContext ctx)
+    {
+        var timeAddress = ctx[CpuRegister.Rdi];
+        if (timeAddress == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        var timeSeconds = unchecked((long)ctx[CpuRegister.Rsi]);
+        if (timeSeconds < 0)
+        {
+            return unchecked((int)0x80B50003);
+        }
+
+        var tick = UnixEpochTicks + unchecked((ulong)timeSeconds) * MicrosecondsPerSecond;
+        if (!TryConvertTickToRtcDateTime(tick, out var time))
+        {
+            return unchecked((int)0x80B50003);
+        }
+
+        if (!TryWriteRtcDateTime(ctx, timeAddress, time))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "n5JiAJXsbcs",
+        ExportName = "sceRtcSetWin32FileTime",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcSetWin32FileTime(CpuContext ctx)
+    {
+        var timeAddress = ctx[CpuRegister.Rdi];
+        if (timeAddress == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        var fileTime = unchecked((long)ctx[CpuRegister.Rsi]);
+        if (fileTime < 0)
+        {
+            return unchecked((int)0x80B50003);
+        }
+
+        var tick = Win32FileTimeEpochTicks + unchecked((ulong)fileTime / 10UL);
+        if (!TryConvertTickToRtcDateTime(tick, out var time))
+        {
+            return unchecked((int)0x80B50003);
+        }
+
+        if (!TryWriteRtcDateTime(ctx, timeAddress, time))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static int AddTickDelta(CpuContext ctx, ulong microsecondsPerUnit)
+    {
+        var destinationAddress = ctx[CpuRegister.Rdi];
+        var sourceAddress = ctx[CpuRegister.Rsi];
+        var delta = unchecked((long)ctx[CpuRegister.Rdx]);
+        if (destinationAddress == 0 || sourceAddress == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        if (!ctx.TryReadUInt64(sourceAddress, out var sourceTick))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        try
+        {
+            var resultTick = checked((long)sourceTick + checked(delta * (long)microsecondsPerUnit));
+            if (resultTick < 0)
+            {
+                return unchecked((int)0x80B50003);
+            }
+
+            if (!ctx.TryWriteUInt64(destinationAddress, unchecked((ulong)resultTick)))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+        }
+        catch (OverflowException)
+        {
+            return unchecked((int)0x80B50003);
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static int AddCalendarDelta(CpuContext ctx, Func<DateTime, DateTime> transform)
+    {
+        var destinationAddress = ctx[CpuRegister.Rdi];
+        var sourceAddress = ctx[CpuRegister.Rsi];
+        if (destinationAddress == 0 || sourceAddress == 0)
+        {
+            return unchecked((int)0x80B50002);
+        }
+
+        if (!ctx.TryReadUInt64(sourceAddress, out var sourceTick))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (!TryConvertTickToDateTime(sourceTick, out var sourceDateTime))
+        {
+            return unchecked((int)0x80B50003);
+        }
+
+        DateTime resultDateTime;
+        try
+        {
+            resultDateTime = transform(sourceDateTime);
+        }
+        catch (ArgumentOutOfRangeException)
+        {
+            return unchecked((int)0x80B50003);
+        }
+
+        if (!TryWriteTickFromDateTime(ctx, destinationAddress, resultDateTime))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static int ValidateRtcDateTime(RtcDateTime time)
+    {
+        if (time.Year < 1 || time.Year > 9999)
+        {
+            return unchecked((int)0x80B50008);
+        }
+
+        if (time.Month < 1 || time.Month > 12)
+        {
+            return unchecked((int)0x80B50009);
+        }
+
+        if (time.Day < 1 || time.Day > DateTime.DaysInMonth(time.Year, time.Month))
+        {
+            return unchecked((int)0x80B5000A);
+        }
+
+        if (time.Hour > 23)
+        {
+            return unchecked((int)0x80B5000B);
+        }
+
+        if (time.Minute > 59)
+        {
+            return unchecked((int)0x80B5000C);
+        }
+
+        if (time.Second > 59)
+        {
+            return unchecked((int)0x80B5000D);
+        }
+
+        if (time.Microsecond > 999_999)
+        {
+            return unchecked((int)0x80B5000E);
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static bool IsValidCalendarDate(int year, int month, int day)
+    {
+        if (year < 1 || year > 9999 || month < 1 || month > 12)
+        {
+            return false;
+        }
+
+        return day >= 1 && day <= DateTime.DaysInMonth(year, month);
+    }
+
+    private static bool TryReadRtcDateTime(CpuContext ctx, ulong address, out RtcDateTime time)
     {
         Span<byte> buffer = stackalloc byte[16];
         if (!ctx.Memory.TryRead(address, buffer))
         {
-            rtcDateTime = default;
+            time = default;
             return false;
         }
 
-        rtcDateTime = new RtcDateTime(
+        time = new RtcDateTime(
             BinaryPrimitives.ReadUInt16LittleEndian(buffer[0..2]),
             BinaryPrimitives.ReadUInt16LittleEndian(buffer[2..4]),
             BinaryPrimitives.ReadUInt16LittleEndian(buffer[4..6]),
@@ -176,19 +831,117 @@ public static class RtcExports
         return true;
     }
 
-    private static bool TryWriteRtcDateTime(CpuContext ctx, ulong address, DateTime dateTime)
+    private static bool TryWriteRtcDateTime(CpuContext ctx, ulong address, RtcDateTime dateTime)
     {
-        Span<byte> rtcDateTime = stackalloc byte[16];
-        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[0..2], checked((ushort)dateTime.Year));
-        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[2..4], checked((ushort)dateTime.Month));
-        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[4..6], checked((ushort)dateTime.Day));
-        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[6..8], checked((ushort)dateTime.Hour));
-        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[8..10], checked((ushort)dateTime.Minute));
-        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[10..12], checked((ushort)dateTime.Second));
-        BinaryPrimitives.WriteUInt32LittleEndian(
-            rtcDateTime[12..16],
-            checked((uint)((dateTime.Ticks % TimeSpan.TicksPerSecond) / DateTimeTicksPerMicrosecond)));
-        return ctx.Memory.TryWrite(address, rtcDateTime);
+        Span<byte> buffer = stackalloc byte[16];
+        BinaryPrimitives.WriteUInt16LittleEndian(buffer[0..2], dateTime.Year);
+        BinaryPrimitives.WriteUInt16LittleEndian(buffer[2..4], dateTime.Month);
+        BinaryPrimitives.WriteUInt16LittleEndian(buffer[4..6], dateTime.Day);
+        BinaryPrimitives.WriteUInt16LittleEndian(buffer[6..8], dateTime.Hour);
+        BinaryPrimitives.WriteUInt16LittleEndian(buffer[8..10], dateTime.Minute);
+        BinaryPrimitives.WriteUInt16LittleEndian(buffer[10..12], dateTime.Second);
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer[12..16], dateTime.Microsecond);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private static RtcDateTime ToRtcDateTime(DateTime dateTime)
+    {
+        return new RtcDateTime(
+            (ushort)dateTime.Year,
+            (ushort)dateTime.Month,
+            (ushort)dateTime.Day,
+            (ushort)dateTime.Hour,
+            (ushort)dateTime.Minute,
+            (ushort)dateTime.Second,
+            (uint)(dateTime.Ticks % TimeSpan.TicksPerSecond / DateTimeTicksPerMicrosecond));
+    }
+
+    private static RtcDateTime ToRtcDateTime(DateTimeOffset dateTimeOffset)
+    {
+        return ToRtcDateTime(dateTimeOffset.DateTime);
+    }
+
+    private static bool TryWriteTickFromDateTime(CpuContext ctx, ulong address, DateTime dateTime)
+    {
+        return ctx.TryWriteUInt64(address, unchecked((ulong)(dateTime.Ticks / DateTimeTicksPerMicrosecond)));
+    }
+
+    private static bool TryConvertTickToDateTime(ulong tick, out DateTime dateTime)
+    {
+        var maxSupportedTick = unchecked((ulong)(DateTime.MaxValue.Ticks / DateTimeTicksPerMicrosecond));
+        if (tick > maxSupportedTick)
+        {
+            dateTime = default;
+            return false;
+        }
+
+        try
+        {
+            dateTime = new DateTime(checked((long)(tick * (ulong)DateTimeTicksPerMicrosecond)), DateTimeKind.Utc);
+            return true;
+        }
+        catch (ArgumentOutOfRangeException)
+        {
+            dateTime = default;
+            return false;
+        }
+    }
+
+    private static bool TryConvertRtcDateTimeToTick(RtcDateTime time, out ulong tick)
+    {
+        try
+        {
+            var year = time.Year;
+            var month = time.Month;
+            var day = time.Day;
+            if (month > 2)
+            {
+                month -= 3;
+            }
+            else
+            {
+                month += 9;
+                year -= 1;
+            }
+
+            var century = year / 100;
+            var yearOfCentury = year - (100 * century);
+
+            ulong days = ((146097UL * (ulong)century) >> 2)
+                + ((1461UL * (ulong)yearOfCentury) >> 2)
+                + ((153UL * (ulong)month + 2UL) / 5UL)
+                + day;
+            days -= 307UL;
+            days *= MicrosecondsPerDay;
+
+            var timeOfDay = (ulong)time.Hour * MicrosecondsPerHour
+                + (ulong)time.Minute * MicrosecondsPerMinute
+                + (ulong)time.Second * MicrosecondsPerSecond
+                + time.Microsecond;
+
+            tick = days + timeOfDay;
+            return true;
+        }
+        catch (OverflowException)
+        {
+            tick = 0;
+            return false;
+        }
+    }
+
+    private static bool TryConvertTickToRtcDateTime(ulong tick, out RtcDateTime time)
+    {
+        try
+        {
+            var dateTime = new DateTime(checked((long)(tick * DateTimeTicksPerMicrosecond)), DateTimeKind.Utc);
+            time = ToRtcDateTime(dateTime);
+            return true;
+        }
+        catch (ArgumentOutOfRangeException)
+        {
+            time = default;
+            return false;
+        }
     }
 
     private readonly record struct RtcDateTime(

src/SharpEmu.Libs/VideoOut/VideoOutExports.cs

@@ -45,6 +45,59 @@ public static class VideoOutExports
     private static readonly object _stateGate = new();
     private static readonly object _frameDumpGate = new();
     private static readonly Dictionary<int, VideoOutPortState> _ports = new();
+
+    // Hardware raises vblank autonomously; UE blocks its frame loop on it.
+    private static Timer? _vblankPumpTimer;
+    private static int _vblankPumpActive;
+    private const int VblankPumpIntervalMs = 16;
+
+    private static void EnsureVblankPumpStarted()
+    {
+        if (_vblankPumpTimer is not null)
+        {
+            return;
+        }
+
+        _vblankPumpTimer = new Timer(
+            static _ => PumpVblanks(),
+            null,
+            VblankPumpIntervalMs,
+            VblankPumpIntervalMs);
+    }
+
+    private static void PumpVblanks()
+    {
+        if (Interlocked.Exchange(ref _vblankPumpActive, 1) != 0)
+        {
+            return;
+        }
+
+        try
+        {
+            VideoOutPortState[] ports;
+            lock (_stateGate)
+            {
+                if (_ports.Count == 0)
+                {
+                    return;
+                }
+
+                // Signalling reaches WakeBlockedThreads -> Pump(), which serialises on one global
+                // flag. Waking an unwatched queue would hold it 60x/sec and starve guest threads.
+                ports = _ports.Values.Where(static port => port.VblankEvents.Count != 0).ToArray();
+            }
+
+            foreach (var port in ports)
+            {
+                SignalVblank(port);
+            }
+        }
+        finally
+        {
+            Volatile.Write(ref _vblankPumpActive, 0);
+        }
+    }
+
     private static readonly Dictionary<(int Handle, int BufferIndex, ulong Address), ulong> _lastFrameFingerprints = new();
     private static int _nextHandle = 1;
     private static int _frameDumpCount;
@@ -177,6 +230,7 @@ public static class VideoOutExports
             {
                 Handle = handle,
             };
+            EnsureVblankPumpStarted();
             return handle;
         }
     }

src/SharpEmu.Libs/VideoOut/VulkanVideoPresenter.cs

@@ -178,6 +178,7 @@ internal static unsafe class VulkanVideoPresenter
     private static uint _windowHeight;
     private static bool _closed;
     private const string DebugUtilsExtensionName = "VK_EXT_debug_utils";
+    private const uint NvidiaVendorId = 0x10DE;
     private static bool _splashHidden;
     private static long _enqueuedGuestWorkSequence;
     private static long _completedGuestWorkSequence;
@@ -1502,6 +1503,13 @@ internal static unsafe class VulkanVideoPresenter
                 Check(_vk.EnumeratePhysicalDevices(_instance, &deviceCount, devicePointer), "vkEnumeratePhysicalDevices");
             }
 
+            // Hybrid laptops enumerate the iGPU first, and AMD's integrated driver
+            // segfaults compiling some translated shaders, so rank rather than take
+            // the first hit. SHARPEMU_VK_DEVICE=<substring> pins an adapter by name.
+            var deviceOverride = Environment.GetEnvironmentVariable("SHARPEMU_VK_DEVICE");
+            var bestScore = int.MinValue;
+            var found = false;
+
             foreach (var device in devices)
             {
                 uint queueCount = 0;
@@ -1521,13 +1529,60 @@ internal static unsafe class VulkanVideoPresenter
                         continue;
                     }
 
-                    _physicalDevice = device;
-                    _queueFamilyIndex = index;
-                    return;
+                    _vk.GetPhysicalDeviceProperties(device, out var properties);
+                    var name = SilkMarshal.PtrToString((nint)properties.DeviceName) ?? string.Empty;
+                    var score = ScorePhysicalDevice(properties, name, deviceOverride);
+                    Console.Error.WriteLine(
+                        $"[LOADER][INFO] Vulkan candidate: {name} ({properties.DeviceType}) score={score}");
+
+                    if (score > bestScore)
+                    {
+                        bestScore = score;
+                        _physicalDevice = device;
+                        _queueFamilyIndex = index;
+                        found = true;
+                    }
+
+                    break;
                 }
             }
 
-            throw new InvalidOperationException("No Vulkan graphics/present queue was found.");
+            if (!found)
+            {
+                throw new InvalidOperationException("No Vulkan graphics/present queue was found.");
+            }
+
+            _vk.GetPhysicalDeviceProperties(_physicalDevice, out var selected);
+            Console.Error.WriteLine(
+                $"[LOADER][INFO] Vulkan device: {SilkMarshal.PtrToString((nint)selected.DeviceName)} ({selected.DeviceType})");
+        }
+
+        private static int ScorePhysicalDevice(
+            PhysicalDeviceProperties properties,
+            string name,
+            string? deviceOverride)
+        {
+            if (!string.IsNullOrWhiteSpace(deviceOverride))
+            {
+                return name.Contains(deviceOverride, StringComparison.OrdinalIgnoreCase) ? 1000 : -1000;
+            }
+
+            var score = properties.DeviceType switch
+            {
+                PhysicalDeviceType.DiscreteGpu => 300,
+                PhysicalDeviceType.VirtualGpu => 100,
+                PhysicalDeviceType.Cpu => 50,
+                // Last resort: only picked when nothing else can present.
+                PhysicalDeviceType.IntegratedGpu => -100,
+                _ => 10,
+            };
+
+            if (properties.VendorID == NvidiaVendorId)
+            {
+                score += 500;
+            }
+
+            return score;
         }
 
         private void CreateDevice()