[memory] Host memory allocation issue fixed

- Enable VertexPipelineStoresAndAtomics/FragmentStoresAndAtomics:
  fixes vkCreateGraphicsPipelines() rejecting guestBuffers storage
  descriptor as NonWritable in vertex/fragment stages.
- Enable ShaderInt64: fixes vkCreateShaderModule() rejecting SPIR-V
  using 64-bit integer capability.
- Query GetPhysicalDeviceFeatures first and only enable what the GPU
  actually reports as supported, with a warning fallback otherwise.

Also adds optional Vulkan Validation Layers (SHARPEMU_VK_VALIDATION=1)
to surface these VUID errors during development instead of silent
VK_ERROR_DEVICE_LOST.

.editorconfig

@@ -14,7 +14,7 @@ indent_size = 4
 indent_style = space
 tab_width = 4
 
-[*.{md,json,yml,props,csproj}]
+[*.{md,json,yml,xml,props,csproj}]
 
 indent_size = 2
 tab_width = 2

.github/workflows/workflow.yml

@@ -126,7 +126,7 @@ jobs:
     needs:
       - init
       - build
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
     runs-on: ubuntu-latest
     permissions:
       contents: write

.gitignore

@@ -26,6 +26,7 @@ arm64/
 *.userosscache
 *.sln.docstates
 
+.packages
 packages/
 *.nupkg
 .nuget/

Directory.Packages.props

@@ -2,7 +2,6 @@
 Copyright (C) 2026 SharpEmu Emulator Project
 SPDX-License-Identifier: GPL-2.0-or-later
 -->
-
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
@@ -10,6 +9,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
   <ItemGroup>
     <PackageVersion Include="Iced" Version="1.21.0" />
     <PackageVersion Include="Silk.NET.Vulkan" Version="2.23.0" />
+    <PackageVersion Include="Silk.NET.Vulkan.Extensions.EXT" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.KHR" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Windowing" Version="2.23.0" />
   </ItemGroup>

REUSE.toml

@@ -3,12 +3,14 @@ version = 1
 [[annotations]]
 path = [
     "REUSE.toml",
+    "nuget.config",
     "global.json",
     "**/packages.lock.json",
     "scripts/ps5_names.txt",
     "src/SharpEmu.HLE/Aerolib/aerolib.bin",
     "_logs/**",
-    ".github/images/**"
+    ".github/images/**",
+    "assets/images/**"
 ]
 precedence = "aggregate"
 SPDX-FileCopyrightText = "SharpEmu Emulator Project"

nuget.config

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<configuration>
+  <config>
+    <add key="globalPackagesFolder" value=".packages" />
+  </config>
+
+  <packageSources>
+    <clear />
+    <add key="Nuget" value="https://api.nuget.org/v3/index.json" />
+  </packageSources>
+
+  <packageSourceMapping>
+    <packageSource key="Nuget">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>

src/SharpEmu.CLI/SharpEmu.CLI.csproj

@@ -16,7 +16,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <RuntimeIdentifiers>win-x64;linux-x64;osx-arm64</RuntimeIdentifiers>
     <SelfContained>true</SelfContained>
     <PublishSingleFile>true</PublishSingleFile>
-    <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract>
+    <!-- <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract> -->
     <EnableCompressionInSingleFile>true</EnableCompressionInSingleFile>
     <ImplicitUsings>enable</ImplicitUsings>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
@@ -30,6 +30,11 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
   </PropertyGroup>
 
+  <PropertyGroup Condition="'$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == ''">
+    <ApplicationIcon>..\..\assets\images\SharpEmu.ico</ApplicationIcon>
+    <Win32Icon>..\..\assets\images\SharpEmu.ico</Win32Icon>
+  </PropertyGroup>
+
   <ItemGroup>
     <Content Include="..\..\LICENSE.txt">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>

src/SharpEmu.CLI/packages.lock.json

@@ -81,6 +81,7 @@
         "dependencies": {
           "SharpEmu.HLE": "[1.0.0, )",
           "Silk.NET.Vulkan": "[2.23.0, )",
+          "Silk.NET.Vulkan.Extensions.EXT": "[2.23.0, )",
           "Silk.NET.Vulkan.Extensions.KHR": "[2.23.0, )",
           "Silk.NET.Windowing": "[2.23.0, )"
         }
@@ -103,6 +104,16 @@
           "Silk.NET.Core": "2.23.0"
         }
       },
+      "Silk.NET.Vulkan.Extensions.EXT": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "+Oth189ksRiL6HvGCwIdnsYHawqrbO8y49u1H61z3wsfcHhQZeVDYe/wF5LD7fk3NcdgDvwFD3mLm1QWhdZySw==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
       "Silk.NET.Vulkan.Extensions.KHR": {
         "type": "CentralTransitive",
         "requested": "[2.23.0, )",

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Imports.cs

@@ -338,10 +338,15 @@ public sealed partial class DirectExecutionBackend
 				{
 					orbisGen2Result = DispatchBootstrapBridge();
 				}
-				else if (string.Equals(importStubEntry.Nid, RuntimeStubNids.KernelDynlibDlsym, StringComparison.Ordinal))
+				else if (string.Equals(importStubEntry.Nid, RuntimeStubNids.KernelDynlibDlsym, StringComparison.Ordinal) ||
+					string.Equals(importStubEntry.Nid, "LwG8g3niqwA", StringComparison.Ordinal))
 				{
 					orbisGen2Result = DispatchKernelDynlibDlsym();
 				}
+				else if (string.Equals(importStubEntry.Nid, "r8mvOaWdi28", StringComparison.Ordinal))
+				{
+					orbisGen2Result = DispatchIl2CppApiLookupSymbol();
+				}
 				else if (importStubEntry.Export is { } cachedExport &&
 					(cachedExport.Target & cpuContext.TargetGeneration) != 0)
 				{
@@ -628,25 +633,56 @@ public sealed partial class DirectExecutionBackend
 			"ASoW5WE-UPo" or // sceKernelAprSubmitCommandBufferAndGetResult
 			"rqwFKI4PAiM" or // sceKernelAprWaitCommandBuffer
 			"eE4Szl8sil8" or // sceKernelAprSubmitCommandBuffer
-			"qvMUCyyaCSI";   // sceKernelAprSubmitCommandBufferAndGetId
+			"qvMUCyyaCSI" or // sceKernelAprSubmitCommandBufferAndGetId
+			"Q2V+iqvjgC0" or // vsnprintf
+			"q1cHNfGycLI" or // scePadRead
+			"xk0AcarP3V4" or // scePadOpen
+			"yH17Q6NWtVg" or // sceUserServiceGetEvent
+			"D-CzAxQL0XI" or // sceUserServiceGetPlatformPrivacySetting
+			"K-jXhbt2gn4";   // scePthreadMutexTrylock
 
 	private bool ShouldLogImportResult(string nid, OrbisGen2Result result)
 	{
+		var resultValue = unchecked((int)result);
+		if (resultValue > 0)
+		{
+			return false;
+		}
+
 		var expectedFileProbeMiss =
 			result == OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND &&
 			IsExpectedFileProbeNotFoundNid(nid);
 		var expectedTimedWaitTimeout =
 			string.Equals(nid, "27bAgiJmOh0", StringComparison.Ordinal) &&
 			unchecked((int)result) == 60;
+		var expectedEqueueTimeout =
+			string.Equals(nid, "fzyMKs9kim0", StringComparison.Ordinal) &&
+			result == OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT;
 		var expectedMutexTrylockBusy =
 			string.Equals(nid, "K-jXhbt2gn4", StringComparison.Ordinal) &&
 			result == OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY;
-		if (!expectedFileProbeMiss && !expectedTimedWaitTimeout && !expectedMutexTrylockBusy)
+		var expectedUserServiceNoEvent =
+			string.Equals(nid, "yH17Q6NWtVg", StringComparison.Ordinal) &&
+			resultValue == unchecked((int)0x80960007);
+		var expectedPrivacyInvalidParameter =
+			string.Equals(nid, "D-CzAxQL0XI", StringComparison.Ordinal) &&
+			resultValue == unchecked((int)0x80960009);
+		if (!expectedFileProbeMiss &&
+			!expectedTimedWaitTimeout &&
+			!expectedEqueueTimeout &&
+			!expectedMutexTrylockBusy &&
+			!expectedUserServiceNoEvent &&
+			!expectedPrivacyInvalidParameter)
 		{
 			return true;
 		}
 
-		var key = nid + "\0" + (int)result;
+		if (!ShouldLogExpectedImportResults())
+		{
+			return false;
+		}
+
+		var key = nid + "\0" + resultValue;
 		int count;
 		lock (_importResultLogSampleGate)
 		{
@@ -658,6 +694,12 @@ public sealed partial class DirectExecutionBackend
 		return count <= 8 || count % 10000 == 0;
 	}
 
+	private static bool ShouldLogExpectedImportResults() =>
+		string.Equals(
+			Environment.GetEnvironmentVariable("SHARPEMU_LOG_EXPECTED_IMPORT_RESULTS"),
+			"1",
+			StringComparison.Ordinal);
+
 	private static bool IsExpectedFileProbeNotFoundNid(string nid) =>
 		nid is
 			"eV9wAD2riIA" or // sceKernelStat
@@ -723,6 +765,7 @@ public sealed partial class DirectExecutionBackend
 			"Vo5V8KAwCmk" or // sceSystemServiceHideSplashScreen
 			"TywrFKCoLGY" or // sceSaveDataInitialize3
 			"dyIhnXq-0SM" or // sceSaveDataDirNameSearch
+			"ZP4e7rlzOUk" or // sceSaveDataMount3
 			"ERKzksauAJA" or // sceSaveDataDialogGetStatus
 			"KK3Bdg1RWK0" or // sceSaveDataDialogUpdateStatus
 			"en7gNVnh878" or // sceSaveDataDialogIsReadyToDisplay
@@ -1179,8 +1222,11 @@ public sealed partial class DirectExecutionBackend
 			cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
 			return OrbisGen2Result.ORBIS_GEN2_OK;
 		}
-		if (!TryResolveRuntimeSymbolAddress(symbolName, out var resolvedAddress))
+		if (!TryResolveRuntimeSymbolAddress(symbolName, out var resolvedAddress) &&
+			!TryResolveRuntimeSymbolAlias(symbolName, out resolvedAddress))
 		{
+			Console.Error.WriteLine(
+				$"[LOADER][WARN] sceKernelDlsym failed: handle=0x{cpuContext[CpuRegister.Rdi]:X} symbol='{symbolName}'");
 			cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
 			return OrbisGen2Result.ORBIS_GEN2_OK;
 		}
@@ -1193,6 +1239,62 @@ public sealed partial class DirectExecutionBackend
 		return OrbisGen2Result.ORBIS_GEN2_OK;
 	}
 
+	private bool TryResolveRuntimeSymbolAlias(string symbolName, out ulong address)
+	{
+		address = 0;
+		var alias = symbolName switch
+		{
+			"scriptingGetMem" => "malloc",
+			"scriptingFreeMem" => "free",
+			"scriptingRealloc" => "realloc",
+			"scriptingCalloc" => "calloc",
+			_ => null,
+		};
+
+		return alias != null && TryResolveRuntimeSymbolAddress(alias, out address);
+	}
+
+	private OrbisGen2Result DispatchIl2CppApiLookupSymbol()
+	{
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null)
+		{
+			return OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+		}
+
+		var symbolNameAddress = cpuContext[CpuRegister.Rdi];
+		var outputAddress = cpuContext[CpuRegister.Rsi];
+		if (!TryReadAsciiZ(symbolNameAddress, 512, out var symbolName) ||
+			outputAddress == 0 ||
+			!TryResolveIl2CppApiAddress(symbolName, out var resolvedAddress) ||
+			!TryWriteUInt64Compat(outputAddress, resolvedAddress))
+		{
+			Console.Error.WriteLine(
+				$"[LOADER][WARN] il2cpp_api_lookup_symbol failed: name='{symbolName}' out=0x{outputAddress:X16}");
+			if (outputAddress != 0)
+			{
+				_ = TryWriteUInt64Compat(outputAddress, 0);
+			}
+
+			cpuContext[CpuRegister.Rax] = ulong.MaxValue;
+			return OrbisGen2Result.ORBIS_GEN2_OK;
+		}
+
+		cpuContext[CpuRegister.Rax] = 0;
+		return OrbisGen2Result.ORBIS_GEN2_OK;
+	}
+
+	private bool TryResolveIl2CppApiAddress(string symbolName, out ulong address)
+	{
+		if (TryResolveRuntimeSymbolAddress(symbolName, out address))
+		{
+			return true;
+		}
+
+		return Aerolib.Instance.TryGetByExportName(symbolName, out var symbol) &&
+			TryResolveRuntimeSymbolAddress(symbol.Nid, out address);
+	}
+
 	private OrbisGen2Result DispatchBootstrapBridge()
 	{
 		var cpuContext = ActiveCpuContext;

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.cs

@@ -355,6 +355,8 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 		public GuestThreadRunState State { get; set; }
 
+		public ulong ExitValue { get; set; }
+
 		public string? BlockReason { get; set; }
 
 		public bool HasBlockedContinuation { get; set; }
@@ -1266,7 +1268,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			   libraryName.IndexOf("Kernel", StringComparison.OrdinalIgnoreCase) >= 0;
 	}
 
-	private static bool PreferLleForLibcExport(string exportName)
+	private bool PreferLleForLibcExport(string exportName)
 	{
 		if (string.IsNullOrWhiteSpace(exportName))
 		{
@@ -1287,6 +1289,10 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		{
 			return true;
 		}
+		if (IsLibcAllocatorExport(exportName))
+		{
+			return CanUseLleLibcAllocatorFamily();
+		}
 		if (string.Equals(value, "0", StringComparison.Ordinal))
 		{
 			return true;
@@ -1298,6 +1304,51 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		return IsSafeLleLibcExport(exportName);
 	}
 
+	private bool CanUseLleLibcAllocatorFamily()
+	{
+		return HasUsableLleLibcExport("gQX+4GDQjpM", "malloc") &&
+			   HasUsableLleLibcExport("tIhsqj0qsFE", "free") &&
+			   HasUsableLleLibcExport("2X5agFjKxMc", "calloc") &&
+			   HasUsableLleLibcExport("Y7aJ1uydPMo", "realloc") &&
+			   HasUsableLleLibcExport("Ujf3KzMvRmI", "memalign") &&
+			   HasUsableLleLibcExport("2Btkg8k24Zg", "aligned_alloc") &&
+			   HasUsableLleLibcExport("cVSk9y8URbc", "posix_memalign");
+	}
+
+	private bool HasUsableLleLibcExport(string nid, string exportName)
+	{
+		if (TryResolveRuntimeSymbolAddress(nid, out var address) && IsDirectImportTargetUsable(address))
+		{
+			return true;
+		}
+
+		foreach (var candidate in EnumerateRuntimeSymbolCandidates(exportName))
+		{
+			if (TryResolveRuntimeSymbolAddress(candidate, out address) && IsDirectImportTargetUsable(address))
+			{
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	private static bool IsLibcAllocatorExport(string exportName)
+	{
+		return exportName switch
+		{
+			"malloc" or
+			"free" or
+			"calloc" or
+			"realloc" or
+			"memalign" or
+			"aligned_alloc" or
+			"posix_memalign" or
+			"malloc_usable_size" => true,
+			_ => false,
+		};
+	}
+
 	private static bool IsSafeLleLibcExport(string exportName)
 	{
 		return exportName switch
@@ -2406,6 +2457,69 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 	public bool SupportsGuestContextTransfer => true;
 
+	public bool TryJoinThread(
+		CpuContext callerContext,
+		ulong threadHandle,
+		out ulong returnValue,
+		out string? error)
+	{
+		returnValue = 0;
+		error = null;
+		if (threadHandle == 0)
+		{
+			error = "thread handle is zero";
+			return false;
+		}
+
+		if (threadHandle == GuestThreadExecution.CurrentGuestThreadHandle)
+		{
+			error = "thread cannot join itself";
+			return false;
+		}
+
+		while (!ActiveForcedGuestExit)
+		{
+			Thread? hostThread;
+			lock (_guestThreadGate)
+			{
+				if (!_guestThreads.TryGetValue(threadHandle, out var thread))
+				{
+					error = $"unknown guest thread 0x{threadHandle:X16}";
+					return false;
+				}
+
+				if (thread.State == GuestThreadRunState.Exited)
+				{
+					returnValue = thread.ExitValue;
+					return true;
+				}
+
+				if (thread.State == GuestThreadRunState.Faulted)
+				{
+					error =
+						$"guest thread 0x{threadHandle:X16} faulted: " +
+						(thread.BlockReason ?? "unknown error");
+					return false;
+				}
+
+				hostThread = thread.HostThread;
+			}
+
+			if (hostThread is not null &&
+				!ReferenceEquals(hostThread, Thread.CurrentThread))
+			{
+				hostThread.Join(1);
+			}
+			else
+			{
+				Thread.Sleep(1);
+			}
+		}
+
+		error = "guest execution stopped while joining thread";
+		return false;
+	}
+
 	public void Pump(CpuContext callerContext, string reason)
 	{
 		_ = callerContext;
@@ -3254,6 +3368,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 				switch (exitReason)
 				{
 					case GuestNativeCallExitReason.Returned:
+						thread.ExitValue = thread.Context[CpuRegister.Rax];
 						thread.State = GuestThreadRunState.Exited;
 						break;
 					case GuestNativeCallExitReason.Blocked:

src/SharpEmu.Core/Memory/PhysicalVirtualMemory.cs

@@ -11,7 +11,9 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 {
     private readonly ReaderWriterLockSlim _gate = new(LockRecursionPolicy.SupportsRecursion);
     private readonly object _guestAllocationGate = new();
+    private readonly object _allocationSearchHintGate = new();
     private readonly List<MemoryRegion> _regions = new();
+    private readonly Dictionary<(ulong DesiredAddress, ulong Alignment, bool Executable), ulong> _allocationSearchHints = new();
     private readonly Dictionary<ulong, ProgramHeaderFlags> _pageProtections = new();
     private bool _disposed;
     private const ulong PageSize = 0x1000;
@@ -19,7 +21,8 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
     private const ulong GuestAllocationArenaSize = 0x0100_0000;
     private const ulong GuestAllocationArenaStartOffset = PageSize;
     private const ulong LargeDataReserveThreshold = 0x4000_0000UL; // 1 GiB
-    private const ulong LazyReservePrimeBytes = 0x5000_0000UL; // 1.25 GiB
+    private const ulong FullCommitRegionLimit = 4UL << 30;
+    private const ulong DefaultLazyReservePrimeBytes = 0x0400_0000UL; // 64 MiB
     private const ulong LazyReservePrimeChunkBytes = 0x0200_0000UL; // 32 MiB
 
     private const uint MEM_COMMIT = 0x1000;
@@ -35,6 +38,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
     private ulong _guestAllocationArenaBase;
     private ulong _guestAllocationOffset;
+    private static readonly ulong LazyReservePrimeBytes = ResolveLazyReservePrimeBytes();
 
     [DllImport("kernel32.dll", SetLastError = true)]
     private static extern void* VirtualAlloc(void* lpAddress, nuint dwSize, uint flAllocationType, uint flProtect);
@@ -81,7 +85,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterWriteLock();
         try
         {
-            _regions.Add(new MemoryRegion
+            InsertRegionSorted(new MemoryRegion
             {
                 VirtualAddress = actualAddress,
                 Size = alignedSize,
@@ -96,7 +100,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         }
 
         var allocationKind = executable ? "executable memory" : "data memory";
-        Console.Error.WriteLine($"[VMEM] Allocated exact {allocationKind}: 0x{actualAddress:X16} - 0x{actualAddress + alignedSize:X16} ({alignedSize} bytes)");
+        TraceVmem($"Allocated exact {allocationKind}: 0x{actualAddress:X16} - 0x{actualAddress + alignedSize:X16} ({alignedSize} bytes)");
         return true;
     }
 
@@ -110,7 +114,9 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         var protection = executable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
         var allocationType = MEM_COMMIT | MEM_RESERVE;
         var reservedOnly = false;
-        var preferReserveOnly = !executable && alignedSize >= LargeDataReserveThreshold;
+        var preferReserveOnly = !executable &&
+            alignedSize >= LargeDataReserveThreshold &&
+            alignedSize > FullCommitRegionLimit;
 
         void* result = null;
         if (preferReserveOnly)
@@ -139,7 +145,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 throw new InvalidOperationException($"Failed to allocate exact mapping at 0x{desiredAddress:X16} ({alignedSize} bytes)");
             }
 
-            Console.Error.WriteLine($"[VMEM] Could not allocate at 0x{desiredAddress:X16}, trying any address...");
+            TraceVmem($"Could not allocate at 0x{desiredAddress:X16}, trying any address...");
             result = VirtualAlloc(null, (nuint)alignedSize, allocationType, protection);
 
             if (result == null)
@@ -193,12 +199,12 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                     lazyPrimeState = committedBytes == primeBytes
                         ? $"ok:{committedBytes:X}"
                         : $"partial:{committedBytes:X}/{primeBytes:X}";
-                    Console.Error.WriteLine($"[VMEM] Primed lazy region: 0x{actualAddress:X16} - 0x{actualAddress + committedBytes:X16} ({committedBytes} bytes)");
+                    TraceVmem($"Primed lazy region: 0x{actualAddress:X16} - 0x{actualAddress + committedBytes:X16} ({committedBytes} bytes)");
                 }
                 else
                 {
                     lazyPrimeState = $"fail:{primeBytes:X}";
-                    Console.Error.WriteLine($"[VMEM] Failed to prime lazy region at 0x{actualAddress:X16} ({primeBytes} bytes), continuing with on-demand commit");
+                    TraceVmem($"Failed to prime lazy region at 0x{actualAddress:X16} ({primeBytes} bytes), continuing with on-demand commit");
                 }
             }
             else
@@ -210,7 +216,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterWriteLock();
         try
         {
-            _regions.Add(new MemoryRegion
+            InsertRegionSorted(new MemoryRegion
             {
                 VirtualAddress = actualAddress,
                 Size = alignedSize,
@@ -227,7 +233,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         var allocationKind = reservedOnly
             ? "reserved data memory (lazy commit)"
             : (executable ? "executable memory" : "data memory");
-        Console.Error.WriteLine($"[VMEM] Allocated {allocationKind}: 0x{actualAddress:X16} - 0x{actualAddress + alignedSize:X16} ({alignedSize} bytes) lazy_prime={lazyPrimeState}");
+        TraceVmem($"Allocated {allocationKind}: 0x{actualAddress:X16} - 0x{actualAddress + alignedSize:X16} ({alignedSize} bytes) lazy_prime={lazyPrimeState}");
 
         return actualAddress;
     }
@@ -247,7 +253,8 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
         var alignedSize = AlignUp(size, PageSize);
         var effectiveAlignment = Math.Max(PageSize, alignment == 0 ? PageSize : alignment);
-        var cursor = AlignUp(desiredAddress, effectiveAlignment);
+        var requestedCursor = AlignUp(desiredAddress, effectiveAlignment);
+        var cursor = GetAllocationSearchCursor(desiredAddress, requestedCursor, effectiveAlignment, executable);
 
         for (var attempt = 0; attempt < 0x10000; attempt++)
         {
@@ -267,6 +274,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 actualAddress = AllocateAt(cursor, alignedSize, executable, allowAlternative: false);
                 if (actualAddress == cursor)
                 {
+                    UpdateAllocationSearchCursor(desiredAddress, effectiveAlignment, executable, actualAddress + alignedSize);
                     return true;
                 }
 
@@ -334,6 +342,10 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 }
                 _regions.Clear();
                 _pageProtections.Clear();
+                lock (_allocationSearchHintGate)
+                {
+                    _allocationSearchHints.Clear();
+                }
             }
             finally
             {
@@ -390,7 +402,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
             ApplySegmentProtection(mapStart, mapEnd, protection);
 
-            Console.Error.WriteLine($"[VMEM] Mapped segment: 0x{virtualAddress:X16} - 0x{virtualAddress + memorySize:X16} (file: {fileData.Length} bytes, prot: {protection})");
+            TraceVmem($"Mapped segment: 0x{virtualAddress:X16} - 0x{virtualAddress + memorySize:X16} (file: {fileData.Length} bytes, prot: {protection})");
         }
         finally
         {
@@ -473,9 +485,13 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterReadLock();
         try
         {
-            foreach (var region in _regions)
+            var region = FindRegion(virtualAddress, (ulong)destination.Length);
-            {
+            if (region is not null &&
-                if (TryResolveRegionOffset(virtualAddress, (ulong)destination.Length, region, out var offset))
+                TryResolveRegionOffset(
+                    virtualAddress,
+                    (ulong)destination.Length,
+                    region,
+                    out var offset))
             {
                 var srcPtr = (void*)(region.VirtualAddress + offset);
                 if (destination.IsEmpty)
@@ -494,9 +510,9 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 if (!CanReadWithoutProtectionChange((ulong)srcPtr, (ulong)destination.Length, region))
                 {
                     requiresExclusiveAccess = true;
-                        break;
                 }
-
+                else
+                {
                     fixed (byte* destPtr = destination)
                     {
                         Buffer.MemoryCopy(srcPtr, destPtr, (nuint)destination.Length, (nuint)destination.Length);
@@ -533,9 +549,13 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterReadLock();
         try
         {
-            foreach (var region in _regions)
+            var region = FindRegion(virtualAddress, (ulong)source.Length);
-            {
+            if (region is not null &&
-                if (TryResolveRegionOffset(virtualAddress, (ulong)source.Length, region, out var offset))
+                TryResolveRegionOffset(
+                    virtualAddress,
+                    (ulong)source.Length,
+                    region,
+                    out var offset))
             {
                 var destPtr = (void*)(region.VirtualAddress + offset);
                 if (source.IsEmpty)
@@ -554,9 +574,9 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 if (!CanWriteWithoutProtectionChange((ulong)destPtr, (ulong)source.Length, region))
                 {
                     requiresExclusiveAccess = true;
-                        break;
                 }
-
+                else
+                {
                     fixed (byte* srcPtr = source)
                     {
                         Buffer.MemoryCopy(srcPtr, destPtr, (nuint)source.Length, (nuint)source.Length);
@@ -589,13 +609,14 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
     private bool TryReadExclusive(ulong virtualAddress, Span<byte> destination)
     {
-        foreach (var region in _regions)
+        var region = FindRegion(virtualAddress, (ulong)destination.Length);
+        if (region is not null &&
+            TryResolveRegionOffset(
+                virtualAddress,
+                (ulong)destination.Length,
+                region,
+                out var offset))
         {
-            if (!TryResolveRegionOffset(virtualAddress, (ulong)destination.Length, region, out var offset))
-            {
-                continue;
-            }
-
             var srcPtr = (void*)(region.VirtualAddress + offset);
             if (!EnsureRangeCommitted((ulong)srcPtr, (ulong)destination.Length, region))
             {
@@ -637,13 +658,14 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
     private bool TryWriteExclusive(ulong virtualAddress, ReadOnlySpan<byte> source)
     {
-        foreach (var region in _regions)
+        var region = FindRegion(virtualAddress, (ulong)source.Length);
+        if (region is not null &&
+            TryResolveRegionOffset(
+                virtualAddress,
+                (ulong)source.Length,
+                region,
+                out var offset))
         {
-            if (!TryResolveRegionOffset(virtualAddress, (ulong)source.Length, region, out var offset))
-            {
-                continue;
-            }
-
             var destPtr = (void*)(region.VirtualAddress + offset);
             if (!EnsureRangeCommitted((ulong)destPtr, (ulong)source.Length, region))
             {
@@ -699,15 +721,9 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterReadLock();
         try
         {
-            foreach (var region in _regions)
+            return FindRegion(virtualAddress, 1) is not null
-            {
+                ? (void*)virtualAddress
-                if (virtualAddress >= region.VirtualAddress &&
+                : null;
-                    virtualAddress < region.VirtualAddress + region.Size)
-                {
-                    return (void*)virtualAddress;
-                }
-            }
-            return null;
         }
         finally
         {
@@ -720,14 +736,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterReadLock();
         try
         {
-            foreach (var region in _regions)
+            return FindRegion(virtualAddress, size) is not null;
-            {
-                if (TryResolveRegionOffset(virtualAddress, size, region, out _))
-                {
-                    return true;
-                }
-            }
-            return false;
         }
         finally
         {
@@ -737,14 +746,48 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
     private MemoryRegion? FindRegion(ulong address, ulong size)
     {
-        foreach (var region in _regions)
+        var low = 0;
+        var high = _regions.Count - 1;
+        MemoryRegion? candidate = null;
+        while (low <= high)
         {
-            if (TryResolveRegionOffset(address, size, region, out _))
+            var middle = low + ((high - low) >> 1);
+            var region = _regions[middle];
+            if (region.VirtualAddress <= address)
             {
-                return region;
+                candidate = region;
+                low = middle + 1;
+            }
+            else
+            {
+                high = middle - 1;
             }
         }
-        return null;
+
+        return candidate is not null &&
+            TryResolveRegionOffset(address, size, candidate, out _)
+                ? candidate
+                : null;
+    }
+
+    private void InsertRegionSorted(MemoryRegion region)
+    {
+        var low = 0;
+        var high = _regions.Count;
+        while (low < high)
+        {
+            var middle = low + ((high - low) >> 1);
+            if (_regions[middle].VirtualAddress < region.VirtualAddress)
+            {
+                low = middle + 1;
+            }
+            else
+            {
+                high = middle;
+            }
+        }
+
+        _regions.Insert(low, region);
     }
 
     private bool TryGetOverlappingRegionEnd(ulong address, ulong size, out ulong overlapEnd)
@@ -762,6 +805,16 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             foreach (var region in _regions)
             {
                 var regionEnd = region.VirtualAddress + region.Size;
+                if (region.VirtualAddress >= end)
+                {
+                    break;
+                }
+
+                if (regionEnd <= address)
+                {
+                    continue;
+                }
+
                 if (address < regionEnd && region.VirtualAddress < end)
                 {
                     overlapEnd = Math.Max(overlapEnd, regionEnd);
@@ -776,6 +829,37 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         return overlapEnd != 0;
     }
 
+    private ulong GetAllocationSearchCursor(
+        ulong desiredAddress,
+        ulong requestedCursor,
+        ulong alignment,
+        bool executable)
+    {
+        lock (_allocationSearchHintGate)
+        {
+            var key = (desiredAddress, alignment, executable);
+            if (_allocationSearchHints.TryGetValue(key, out var hintedCursor) &&
+                hintedCursor > requestedCursor)
+            {
+                return AlignUp(hintedCursor, alignment);
+            }
+        }
+
+        return requestedCursor;
+    }
+
+    private void UpdateAllocationSearchCursor(
+        ulong desiredAddress,
+        ulong alignment,
+        bool executable,
+        ulong nextCursor)
+    {
+        lock (_allocationSearchHintGate)
+        {
+            _allocationSearchHints[(desiredAddress, alignment, executable)] = AlignUp(nextCursor, alignment);
+        }
+    }
+
     private static bool TryResolveRegionOffset(ulong address, ulong size, MemoryRegion region, out ulong offset)
     {
         offset = 0;
@@ -944,6 +1028,29 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         return checked((value + mask) & ~mask);
     }
 
+    private static ulong ResolveLazyReservePrimeBytes()
+    {
+        var configured = Environment.GetEnvironmentVariable("SHARPEMU_LAZY_RESERVE_PRIME_MB");
+        if (ulong.TryParse(configured, out var megabytes))
+        {
+            return megabytes == 0
+                ? 0
+                : checked(Math.Min(megabytes, 4096UL) * 1024UL * 1024UL);
+        }
+
+        return DefaultLazyReservePrimeBytes;
+    }
+
+    private static void TraceVmem(string message)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_VMEM"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine($"[VMEM] {message}");
+    }
+
     public void Dispose()
     {
         if (!_disposed)

src/SharpEmu.Core/Runtime/SharpEmuRuntime.cs

@@ -543,6 +543,7 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
         {
             Path.Combine(ebootDirectory, "sce_module"),
             Path.Combine(ebootDirectory, "sce_modules"),
+            Path.Combine(ebootDirectory, "Media", "Modules"),
         }
         .Distinct(StringComparer.OrdinalIgnoreCase)
         .Where(Directory.Exists)
@@ -554,7 +555,9 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
         }
 
         var allModulePaths = moduleDirectories
-            .SelectMany(Directory.EnumerateFiles)
+            .SelectMany(directory => Directory
+                .EnumerateFiles(directory)
+                .OrderBy(path => path, StringComparer.OrdinalIgnoreCase))
             .Where(path =>
             {
                 var extension = Path.GetExtension(path);
@@ -562,7 +565,6 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
                        string.Equals(extension, ".sprx", StringComparison.OrdinalIgnoreCase);
             })
             .Distinct(StringComparer.OrdinalIgnoreCase)
-            .OrderBy(path => path, StringComparer.OrdinalIgnoreCase)
             .ToArray();
 
         var modulePaths = allModulePaths

src/SharpEmu.Core/packages.lock.json

@@ -72,6 +72,7 @@
         "dependencies": {
           "SharpEmu.HLE": "[1.0.0, )",
           "Silk.NET.Vulkan": "[2.23.0, )",
+          "Silk.NET.Vulkan.Extensions.EXT": "[2.23.0, )",
           "Silk.NET.Vulkan.Extensions.KHR": "[2.23.0, )",
           "Silk.NET.Windowing": "[2.23.0, )"
         }
@@ -88,6 +89,16 @@
           "Silk.NET.Core": "2.23.0"
         }
       },
+      "Silk.NET.Vulkan.Extensions.EXT": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "+Oth189ksRiL6HvGCwIdnsYHawqrbO8y49u1H61z3wsfcHhQZeVDYe/wF5LD7fk3NcdgDvwFD3mLm1QWhdZySw==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
       "Silk.NET.Vulkan.Extensions.KHR": {
         "type": "CentralTransitive",
         "requested": "[2.23.0, )",

src/SharpEmu.HLE/GuestThreadExecution.cs

@@ -29,6 +29,12 @@ public interface IGuestThreadScheduler
 
     bool TryStartThread(CpuContext creatorContext, GuestThreadStartRequest request, out string? error);
 
+    bool TryJoinThread(
+        CpuContext callerContext,
+        ulong threadHandle,
+        out ulong returnValue,
+        out string? error);
+
     void Pump(CpuContext callerContext, string reason);
 
     int WakeBlockedThreads(string wakeKey, int maxCount = int.MaxValue);

src/SharpEmu.Libs/Agc/AgcExports.cs

@@ -142,7 +142,7 @@ public static class AgcExports
     private static readonly HashSet<uint> _tracedDcbSizes = new();
     private static readonly HashSet<(ulong Es, ulong Ps, GuestDrawKind Kind)> _tracedShaderTranslations = new();
     private static readonly HashSet<(ulong Es, ulong Ps)> _tracedShaderDecodePairs = new();
-    private static readonly HashSet<(ulong Es, ulong Ps, ulong Target)> _tracedShaderDraws = new();
+    private static readonly HashSet<(ulong Es, ulong Ps, ulong Target, ulong Texture, uint VertexCount)> _tracedShaderDraws = new();
     private static readonly HashSet<(ulong Ps, string Error)> _tracedShaderFailures = new();
     private static readonly HashSet<(int Handle, int Index, ulong Address, string Path)> _tracedDisplayBuffers = new();
     private static readonly HashSet<ulong> _tracedComputeShaders = new();
@@ -155,6 +155,16 @@ public static class AgcExports
         (ulong Cs, ulong State, uint LocalX, uint LocalY, uint LocalZ),
         byte[]> _computeSpirvCache = new();
     private static readonly Dictionary<ulong, ulong> _shaderHeadersByCode = new();
+    private static readonly bool _traceAgc = string.Equals(
+        Environment.GetEnvironmentVariable("SHARPEMU_LOG_AGC"),
+        "1",
+        StringComparison.Ordinal);
+    private static readonly bool _traceAgcShader =
+        _traceAgc ||
+        string.Equals(
+            Environment.GetEnvironmentVariable("SHARPEMU_LOG_AGC_SHADER"),
+            "1",
+            StringComparison.Ordinal);
     private static long _dcbWriteDataTraceCount;
     private static long _dcbWaitRegMemTraceCount;
     private static long _createShaderTraceCount;
@@ -1194,6 +1204,51 @@ public static class AgcExports
         return ReturnPointer(ctx, commandAddress);
     }
 
+    [SysAbiExport(
+        Nid = "q88lQ+GP5Yk",
+        ExportName = "sceAgcDcbDrawIndex",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAgc")]
+    public static int DcbDrawIndex(CpuContext ctx)
+    {
+        var commandBufferAddress = ctx[CpuRegister.Rdi];
+        var indexCount = (uint)ctx[CpuRegister.Rsi];
+        var indexAddress = ctx[CpuRegister.Rdx];
+        var modifier = (uint)ctx[CpuRegister.Rcx];
+
+        if (commandBufferAddress == 0 || modifier != 0x4000_0000)
+        {
+            return ReturnPointer(ctx, 0);
+        }
+
+        if (!TryAllocateCommandDwords(ctx, commandBufferAddress, 5, out var baseCommand) ||
+            !TryWriteUInt32(ctx, baseCommand, Pm4(3, ItIndexBase, 0)) ||
+            !TryWriteUInt32(ctx, baseCommand + 4, (uint)indexAddress) ||
+            !TryWriteUInt32(ctx, baseCommand + 8, (uint)(indexAddress >> 32)) ||
+            !TryWriteUInt32(ctx, baseCommand + 12, Pm4(2, ItIndexBufferSize, 0)) ||
+            !TryWriteUInt32(ctx, baseCommand + 16, indexCount))
+        {
+            return ReturnPointer(ctx, 0);
+        }
+
+        if (!TryAllocateCommandDwords(ctx, commandBufferAddress, 5, out var drawCommand) ||
+            !TryWriteUInt32(ctx, drawCommand, Pm4(5, ItDrawIndex2, 0)) ||
+            !TryWriteUInt32(ctx, drawCommand + 4, indexCount) ||
+            !TryWriteUInt32(ctx, drawCommand + 8, 0) ||
+            !TryWriteUInt32(ctx, drawCommand + 12, 0) ||
+            !TryWriteUInt32(ctx, drawCommand + 16, 0))
+        {
+            return ReturnPointer(ctx, 0);
+        }
+
+        TraceAgc(
+            $"agc.dcb_draw_index buf=0x{commandBufferAddress:X16} " +
+            $"base=0x{baseCommand:X16} draw=0x{drawCommand:X16} " +
+            $"count={indexCount} index=0x{indexAddress:X16}");
+
+        return ReturnPointer(ctx, drawCommand);
+    }
+
     [SysAbiExport(
         Nid = "Yw0jKSqop+E",
         ExportName = "sceAgcDcbDrawIndexAuto",
@@ -1996,6 +2051,88 @@ public static class AgcExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+    Nid = "uJziRsODk1c",
+    ExportName = "sceAgcDriverGetResourceRegistrationMaxNameLength",
+    Target = Generation.Gen5,
+    LibraryName = "libSceAgc")]
+    public static int DriverGetResourceRegistrationMaxNameLength(CpuContext ctx)
+    {
+        var outAddress = ctx[CpuRegister.Rdi];
+
+        if (outAddress == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!TryWriteUInt32(ctx, outAddress, 256))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceAgc($"agc.driver_get_resource_registration_max_name_length out=0x{outAddress:X16} value=256");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    private const uint DefaultAgcOwner = 1;
+    [SysAbiExport(
+        Nid = "F0ZXt5q0ZTA",
+        ExportName = "sceAgcDriverGetDefaultOwner",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAgc")]
+    public static int DriverGetDefaultOwner(CpuContext ctx)
+    {
+        var ownerAddress = ctx[CpuRegister.Rdi];
+
+        if (ownerAddress == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!TryWriteUInt32(ctx, ownerAddress, DefaultAgcOwner))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceAgc($"agc.driver_get_default_owner out=0x{ownerAddress:X16} owner={DefaultAgcOwner}");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+    Nid = "W5z4eZrjEas",
+    ExportName = "sceAgcDriverRegisterResource",
+    Target = Generation.Gen5,
+    LibraryName = "libSceAgc")]
+    public static int DriverRegisterResource(CpuContext ctx)
+    {
+        var resourceAddress = ctx[CpuRegister.Rdi];
+        var owner = (uint)ctx[CpuRegister.Rsi];
+        var nameAddress = ctx[CpuRegister.Rdx];
+        var type = (uint)ctx[CpuRegister.R8];
+        var flags = (uint)ctx[CpuRegister.R9];
+
+        TraceAgc(
+            $"agc.driver_register_resource resource=0x{resourceAddress:X16} owner={owner} " +
+            $"name=0x{nameAddress:X16} type={type} flags={flags}");
+
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+    Nid = "-KRzWekV120",
+    ExportName = "sceAgcDriverUnknown_KRzWekV120",
+    Target = Generation.Gen5,
+    LibraryName = "libSceAgc")]
+    public static int DriverUnknownKRzWekV120(CpuContext ctx)
+    {
+        TraceAgc(
+            $"agc.driver_unknown_krz rdi=0x{ctx[CpuRegister.Rdi]:X16} " +
+            $"rsi=0x{ctx[CpuRegister.Rsi]:X16} rdx=0x{ctx[CpuRegister.Rdx]:X16} " +
+            $"rcx=0x{ctx[CpuRegister.Rcx]:X16} r8=0x{ctx[CpuRegister.R8]:X16} r9=0x{ctx[CpuRegister.R9]:X16}");
+
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
     [SysAbiExport(
         Nid = "h9z6+0hEydk",
         ExportName = "sceAgcSuspendPoint",
@@ -2788,7 +2925,7 @@ public static class AgcExports
                 $"ps=0x{(hasPixelShader ? pixelShaderAddress : 0):X16}");
         }
 
-        if (vertexCount is not (3 or 4 or 6))
+        if (vertexCount == 0 || vertexCount > 1_048_576)
         {
             return;
         }
@@ -2872,8 +3009,9 @@ public static class AgcExports
 
             lock (_submitTraceGate)
             {
+                var firstTextureAddress = translatedDraw.Textures.FirstOrDefault()?.Descriptor.Address ?? 0;
                 if (_tracedShaderDraws.Add(
-                        (exportShaderAddress, pixelShaderAddress, firstTarget.Address)))
+                        (exportShaderAddress, pixelShaderAddress, firstTarget.Address, firstTextureAddress, vertexCount)))
                 {
                     TraceTranslatedGuestDraw(
                         ctx,
@@ -3033,6 +3171,11 @@ public static class AgcExports
                 return false;
             }
 
+            TraceAgcShader(
+                $"agc.texture_binding ps=0x{pixelShaderAddress:X16} es=0x{exportShaderAddress:X16} " +
+                $"pc=0x{binding.Pc:X} op={binding.Opcode} storage={(Gen5ShaderTranslator.IsStorageImageOperation(binding.Opcode) ? 1 : 0)} " +
+                $"decoded={FormatTextureDescriptor(texture)} " +
+                $"raw={FormatShaderDwords(binding.ResourceDescriptor)} sampler={FormatShaderDwords(binding.SamplerDescriptor)}");
             textures.Add(
                 new TranslatedImageBinding(
                     texture,
@@ -3466,7 +3609,7 @@ public static class AgcExports
             ',',
             draw.GlobalMemoryBindings.Select((binding, index) =>
                 $"{index}:0x{binding.BaseAddress:X16}:{binding.Data.Length}:" +
-                Convert.ToHexString(binding.Data.AsSpan(0, Math.Min(binding.Data.Length, 32)))));
+                Convert.ToHexString(binding.Data.AsSpan(0, Math.Min(binding.Data.Length, 256)))));
         var indices = draw.IndexBuffer is { } indexBuffer
             ? $"{(indexBuffer.Is32Bit ? 32 : 16)}:" +
               Convert.ToHexString(indexBuffer.Data.AsSpan(0, Math.Min(indexBuffer.Data.Length, 32)))
@@ -3477,7 +3620,8 @@ public static class AgcExports
                 ',',
                 draw.VertexInputs.Select(input =>
                     $"{input.Location}:pc=0x{input.Pc:X}:0x{input.BaseAddress:X16}" +
-                    $":stride{input.Stride}:off{input.OffsetBytes}:c{input.ComponentCount}"));
+                    $":stride{input.Stride}:off{input.OffsetBytes}:c{input.ComponentCount}" +
+                    $":fmt{input.DataFormat}/num{input.NumberFormat}"));
         var scissor = draw.RenderState.Scissor is { } drawScissor
             ? $"{drawScissor.X},{drawScissor.Y},{drawScissor.Width}x{drawScissor.Height}"
             : "full";
@@ -3486,6 +3630,29 @@ public static class AgcExports
               $"{drawViewport.Width:0.###}x{drawViewport.Height:0.###}:" +
               $"{drawViewport.MinDepth:0.###}-{drawViewport.MaxDepth:0.###}"
             : "full";
+        var rasterRegisters = new (string Name, uint Offset)[]
+        {
+            ("screen_tl", PaScScreenScissorTl),
+            ("screen_br", PaScScreenScissorBr),
+            ("window_off", PaScWindowOffset),
+            ("window_tl", PaScWindowScissorTl),
+            ("window_br", PaScWindowScissorBr),
+            ("generic_tl", PaScGenericScissorTl),
+            ("generic_br", PaScGenericScissorBr),
+            ("vport_tl", PaScVportScissor0Tl),
+            ("vport_br", PaScVportScissor0Br),
+            ("mode", PaScModeCntl0),
+            ("xscale", PaClVportXScale),
+            ("xoffset", PaClVportXOffset),
+            ("yscale", PaClVportYScale),
+            ("yoffset", PaClVportYOffset),
+        };
+        var raster = string.Join(
+            ',',
+            rasterRegisters.Select(entry =>
+                state.CxRegisters.TryGetValue(entry.Offset, out var value)
+                    ? $"{entry.Name}=0x{value:X8}"
+                    : $"{entry.Name}=missing"));
         var blend = draw.RenderState.Blend;
         TraceAgcShader(
             $"agc.shader_draw es=0x{draw.ExportShaderAddress:X16} " +
@@ -3493,6 +3660,7 @@ public static class AgcExports
             $"primitive=0x{draw.PrimitiveType:X} " +
             $"blend={(blend.Enable ? 1 : 0)}:{blend.ColorSrcFactor}/{blend.ColorDstFactor}/{blend.ColorFunc} " +
             $"write_mask=0x{blend.WriteMask:X} scissor={scissor} viewport={viewport} " +
+            $"raster=[{raster}] " +
             $"ps_ena=0x{psInputEna:X8} ps_addr=0x{psInputAddr:X8} " +
             $"targets=[{targets}] textures=[{textures}] " +
             $"buffers=[{buffers}] vertex=[{vertexInputs}] indices=[{indices}]");
@@ -3550,6 +3718,8 @@ public static class AgcExports
             buffers[index] = new VulkanGuestVertexBuffer(
                 binding.Location,
                 binding.ComponentCount,
+                binding.DataFormat,
+                binding.NumberFormat,
                 binding.BaseAddress,
                 binding.Stride,
                 binding.OffsetBytes,
@@ -3574,12 +3744,15 @@ public static class AgcExports
             descriptor.Width > 8192 ||
             descriptor.Height > 8192)
         {
-            texture = CreateFallbackGuestDrawTexture(isStorage);
+            texture = CreateFallbackGuestDrawTexture(isStorage, descriptor.Format, descriptor.NumberType);
             return true;
         }
 
         var sourceWidth = descriptor.TileMode == 0
-            ? Math.Max(descriptor.Width, descriptor.Pitch)
+            ? GetLinearTexturePitch(
+                Math.Max(descriptor.Width, descriptor.Pitch),
+                descriptor.Height,
+                descriptor.Format)
             : descriptor.Width;
         var sourceByteCount = GetTextureByteCount(
             descriptor.Format,
@@ -3589,7 +3762,32 @@ public static class AgcExports
             sourceByteCount > MaxPresentedTextureBytes ||
             sourceByteCount > int.MaxValue)
         {
-            texture = CreateFallbackGuestDrawTexture(isStorage);
+            texture = CreateFallbackGuestDrawTexture(isStorage, descriptor.Format, descriptor.NumberType);
+            return true;
+        }
+
+        if (!isStorage &&
+            descriptor.Address != 0 &&
+            VulkanVideoPresenter.IsGuestImageAvailable(
+                descriptor.Address,
+                descriptor.Format,
+                descriptor.NumberType))
+        {
+            texture = new VulkanGuestDrawTexture(
+                descriptor.Address,
+                descriptor.Width,
+                descriptor.Height,
+                descriptor.Format,
+                descriptor.NumberType,
+                [],
+                IsFallback: false,
+                IsStorage: false,
+                MipLevels: descriptor.MipLevels,
+                MipLevel: mipLevel,
+                Pitch: sourceWidth,
+                TileMode: descriptor.TileMode,
+                DstSelect: descriptor.DstSelect,
+                Sampler: ToVulkanSampler(samplerDescriptor));
             return true;
         }
 
@@ -3617,7 +3815,7 @@ public static class AgcExports
                 IsStorage: true,
                 MipLevels: descriptor.MipLevels,
                 MipLevel: mipLevel,
-                Pitch: descriptor.Pitch,
+                Pitch: sourceWidth,
                 TileMode: descriptor.TileMode,
                 DstSelect: descriptor.DstSelect,
                 Sampler: ToVulkanSampler(samplerDescriptor));
@@ -3627,7 +3825,7 @@ public static class AgcExports
         var source = new byte[(int)sourceByteCount];
         if (!ctx.Memory.TryRead(descriptor.Address, source))
         {
-            texture = CreateFallbackGuestDrawTexture(isStorage);
+            texture = CreateFallbackGuestDrawTexture(isStorage, descriptor.Format, descriptor.NumberType);
             return true;
         }
 
@@ -3663,25 +3861,32 @@ public static class AgcExports
             IsStorage: isStorage,
             MipLevels: descriptor.MipLevels,
             MipLevel: mipLevel,
-            Pitch: descriptor.Pitch,
+            Pitch: sourceWidth,
             TileMode: descriptor.TileMode,
             DstSelect: descriptor.DstSelect,
             Sampler: ToVulkanSampler(samplerDescriptor));
         return true;
     }
 
-    private static VulkanGuestDrawTexture CreateFallbackGuestDrawTexture(bool isStorage = false) =>
+    private static VulkanGuestDrawTexture CreateFallbackGuestDrawTexture(
-        new(
+        bool isStorage,
+        uint format,
+        uint numberType)
+    {
+        var fallbackFormat = format == 0 ? 10u : format;
+        var fallbackNumberType = numberType;
+        return new(
             0,
             1,
             1,
-            56,
+            fallbackFormat,
-            NumberType: 0,
+            fallbackNumberType,
             [0, 0, 0, 255],
             IsFallback: true,
             IsStorage: isStorage,
             MipLevels: 1,
             MipLevel: 0);
+    }
 
     private static VulkanGuestSampler ToVulkanSampler(IReadOnlyList<uint> descriptor) =>
         descriptor.Count >= 4
@@ -4326,6 +4531,28 @@ public static class AgcExports
             : checked(((ulong)width + 3) / 4 * (((ulong)height + 3) / 4) * blockBytes);
     }
 
+    private static uint GetLinearTexturePitch(uint pitch, uint height, uint format)
+    {
+        var bytesPerTexel = GetTextureBytesPerTexel(format);
+        if (bytesPerTexel == 0 || height == 0)
+        {
+            return pitch;
+        }
+
+        var pitchAlignment = Math.Max(8UL, 64UL / bytesPerTexel);
+        var alignedPitch = AlignUp(pitch, pitchAlignment);
+        var sliceAlignment = Math.Max(64UL, 256UL / bytesPerTexel);
+        while ((alignedPitch * height) % sliceAlignment != 0)
+        {
+            alignedPitch += pitchAlignment;
+        }
+
+        return checked((uint)alignedPitch);
+    }
+
+    private static ulong AlignUp(ulong value, ulong alignment) =>
+        (value + alignment - 1) & ~(alignment - 1);
+
     private static void TraceShaderTranslationMiss(
         CpuContext ctx,
         SubmittedDcbState state,
@@ -4594,6 +4821,10 @@ public static class AgcExports
             return false;
         }
 
+        // GFX10/RDNA2 T# layout: WIDTH is split across word1[31:30] (lo 2 bits)
+        // and word2[11:0] (hi 12 bits); FORMAT is the combined 9-bit field at
+        // word1[28:20]. Verified against Kyty's decode of the same game
+        // descriptors (fmt=56=8_8_8_8_UNORM, extent 1280x720, sw_mode 27).
         // GNM T# exposes a 38-bit baseaddr256 field, but RPCSX and the
         // Demon's Souls descriptors both show that only the low 32 bits are
         // part of the guest GPU VA. The upper baseaddr bits carry resource
@@ -5343,7 +5574,7 @@ public static class AgcExports
 
     private static void TraceAgc(string message)
     {
-        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_AGC"), "1", StringComparison.Ordinal))
+        if (!_traceAgc)
         {
             return;
         }
@@ -5353,8 +5584,7 @@ public static class AgcExports
 
     private static void TraceAgcShader(string message)
     {
-        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_AGC"), "1", StringComparison.Ordinal) &&
+        if (!_traceAgcShader)
-            !string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_AGC_SHADER"), "1", StringComparison.Ordinal))
         {
             return;
         }
@@ -5367,6 +5597,12 @@ public static class AgcExports
             ? "none"
             : string.Join(',', values.Select(static value => $"{value:X8}"));
 
+    private static string FormatTextureDescriptor(TextureDescriptor descriptor) =>
+        $"addr=0x{descriptor.Address:X16} {descriptor.Width}x{descriptor.Height} " +
+        $"fmt={descriptor.Format} num={descriptor.NumberType} tile={descriptor.TileMode} " +
+        $"type={descriptor.Type} levels={descriptor.BaseLevel}-{descriptor.LastLevel} " +
+        $"pitch={descriptor.Pitch} dst=0x{descriptor.DstSelect:X3}";
+
     private static void DumpSpirv(
         string stage,
         ulong shaderAddress,

src/SharpEmu.Libs/Agc/Gen5ShaderIr.cs

@@ -276,6 +276,8 @@ internal sealed record Gen5VertexInputBinding(
     uint Pc,
     uint Location,
     uint ComponentCount,
+    uint DataFormat,
+    uint NumberFormat,
     ulong BaseAddress,
     uint Stride,
     uint OffsetBytes,

src/SharpEmu.Libs/Agc/Gen5ShaderScalarEvaluator.cs

@@ -20,7 +20,9 @@ internal static class Gen5ShaderScalarEvaluator
         ulong BaseAddress,
         uint Stride,
         uint NumRecords,
-        ulong SizeBytes);
+        ulong SizeBytes,
+        uint NumberFormat,
+        uint DataFormat);
 
     public static bool TryResolveImageBindings(
         CpuContext ctx,
@@ -400,14 +402,21 @@ internal static class Gen5ShaderScalarEvaluator
             return false;
         }
 
+        var bindingData = data;
+        var bindingStride = descriptor.Stride;
+        var bindingOffset = unchecked((uint)control.OffsetBytes + scalarOffset);
+        var bindingDataFormat = descriptor.DataFormat;
+        var bindingNumberFormat = descriptor.NumberFormat;
         binding = new Gen5VertexInputBinding(
             instruction.Pc,
             location,
             control.DwordCount,
+            bindingDataFormat,
+            bindingNumberFormat,
             descriptor.BaseAddress,
-            descriptor.Stride,
+            bindingStride,
-            unchecked((uint)control.OffsetBytes + scalarOffset),
+            bindingOffset,
-            data);
+            bindingData);
         return true;
     }
 
@@ -803,7 +812,11 @@ internal static class Gen5ShaderScalarEvaluator
                 "SFF1I32B32" => left == 0 ? uint.MaxValue : (uint)BitOperations.TrailingZeroCount(left),
                 _ => registers[destination.Value] | (1u << ((int)left & 31)),
             };
+            if (instruction.Opcode != "SBitset1B32")
+            {
                 scalarConditionCode = registers[destination.Value] != 0;
+            }
+
             return true;
         }
 
@@ -829,13 +842,15 @@ internal static class Gen5ShaderScalarEvaluator
                 }
             case "SSubU32":
                 result = left - right;
-                scalarConditionCode = left >= right;
+                scalarConditionCode = right > left;
                 break;
             case "SAddI32":
                 result = unchecked((uint)((int)left + (int)right));
+                scalarConditionCode = SignedAddOverflow(left, right, result);
                 break;
             case "SSubI32":
                 result = unchecked((uint)((int)left - (int)right));
+                scalarConditionCode = SignedSubOverflow(left, right, result);
                 break;
             case "SAddcU32":
                 {
@@ -846,23 +861,27 @@ internal static class Gen5ShaderScalarEvaluator
                 }
             case "SSubbU32":
                 {
-                    var borrow = scalarConditionCode ? 0UL : 1UL;
+                    var borrow = scalarConditionCode ? 1UL : 0UL;
                     var subtrahend = (ulong)right + borrow;
                     result = unchecked(left - (uint)subtrahend);
-                    scalarConditionCode = left >= subtrahend;
+                    scalarConditionCode = subtrahend > left;
                     break;
                 }
             case "SMinI32":
                 result = unchecked((uint)Math.Min((int)left, (int)right));
+                scalarConditionCode = (int)left < (int)right;
                 break;
             case "SMinU32":
                 result = Math.Min(left, right);
+                scalarConditionCode = left < right;
                 break;
             case "SMaxI32":
                 result = unchecked((uint)Math.Max((int)left, (int)right));
+                scalarConditionCode = (int)left > (int)right;
                 break;
             case "SMaxU32":
                 result = Math.Max(left, right);
+                scalarConditionCode = left > right;
                 break;
             case "SCselectB32":
                 result = scalarConditionCode ? left : right;
@@ -926,6 +945,7 @@ internal static class Gen5ShaderScalarEvaluator
                     var offset = (int)right & 31;
                     var width = Math.Min(((int)right >> 16) & 0x7F, 32 - offset);
                     result = width == 0 ? 0 : left >> offset & (uint.MaxValue >> (32 - width));
+                    scalarConditionCode = result != 0;
                     break;
                 }
             case "SBfeI32":
@@ -935,23 +955,41 @@ internal static class Gen5ShaderScalarEvaluator
                     result = width == 0
                         ? 0
                         : unchecked((uint)(((int)(left << (32 - width - offset))) >> (32 - width)));
+                    scalarConditionCode = result != 0;
                     break;
                 }
             case "SAbsdiffI32":
                 result = unchecked((uint)Math.Abs((long)(int)left - (int)right));
+                scalarConditionCode = result != 0;
                 break;
             case "SLshl1AddU32":
-                result = (left << 1) + right;
+                {
+                    var wide = ((ulong)left << 1) + right;
+                    result = (uint)wide;
+                    scalarConditionCode = wide > uint.MaxValue;
                     break;
+                }
             case "SLshl2AddU32":
-                result = (left << 2) + right;
+                {
+                    var wide = ((ulong)left << 2) + right;
+                    result = (uint)wide;
+                    scalarConditionCode = wide > uint.MaxValue;
                     break;
+                }
             case "SLshl3AddU32":
-                result = (left << 3) + right;
+                {
+                    var wide = ((ulong)left << 3) + right;
+                    result = (uint)wide;
+                    scalarConditionCode = wide > uint.MaxValue;
                     break;
+                }
             case "SLshl4AddU32":
-                result = (left << 4) + right;
+                {
+                    var wide = ((ulong)left << 4) + right;
+                    result = (uint)wide;
+                    scalarConditionCode = wide > uint.MaxValue;
                     break;
+                }
             case "SPackLlB32B16":
                 result = (left & 0xFFFFu) | (right << 16);
                 break;
@@ -993,7 +1031,8 @@ internal static class Gen5ShaderScalarEvaluator
             "SNandSaveexecB64" or
             "SNorSaveexecB64" or
             "SXnorSaveexecB64" or
-            "SAndn1SaveexecB64"))
+            "SAndn1SaveexecB64" or
+            "SOrn1SaveexecB64"))
         {
             return false;
         }
@@ -1021,11 +1060,12 @@ internal static class Gen5ShaderScalarEvaluator
             "SAndSaveexecB64" => oldExec & source,
             "SOrSaveexecB64" => oldExec | source,
             "SXorSaveexecB64" => oldExec ^ source,
-            "SAndn1SaveexecB64" => ~oldExec & source,
+            "SAndn1SaveexecB64" => ~source & oldExec,
-            "SAndn2SaveexecB64" => oldExec & ~source,
+            "SAndn2SaveexecB64" => source & ~oldExec,
-            "SOrn2SaveexecB64" => oldExec | ~source,
+            "SOrn1SaveexecB64" => ~source | oldExec,
-            "SNandSaveexecB64" => ~(oldExec & source),
+            "SOrn2SaveexecB64" => source | ~oldExec,
-            "SNorSaveexecB64" => ~(oldExec | source),
+            "SNandSaveexecB64" => ~(source & oldExec),
+            "SNorSaveexecB64" => ~(source | oldExec),
             _ => ~(oldExec ^ source),
         };
 
@@ -1095,6 +1135,12 @@ internal static class Gen5ShaderScalarEvaluator
 
     private static ulong MaskWaveValue(ulong value) => value & RdnaWaveMask;
 
+    private static bool SignedAddOverflow(uint left, uint right, uint result) =>
+        ((left ^ result) & (right ^ result) & 0x80000000u) != 0;
+
+    private static bool SignedSubOverflow(uint left, uint right, uint result) =>
+        ((left ^ right) & (left ^ result) & 0x80000000u) != 0;
+
     private static bool TryExecuteScalarCompare(
         Gen5ShaderInstruction instruction,
         uint[] registers,
@@ -1416,7 +1462,7 @@ internal static class Gen5ShaderScalarEvaluator
             word2 == 0 &&
             word3 == 0)
         {
-            descriptor = new BufferDescriptor(0, 0, 0, 0);
+            descriptor = new BufferDescriptor(0, 0, 0, 0, 0, 0);
             return true;
         }
 
@@ -1428,19 +1474,64 @@ internal static class Gen5ShaderScalarEvaluator
                 return false;
             }
 
-            descriptor = new BufferDescriptor(0, 0, 0, 0);
+            descriptor = new BufferDescriptor(0, 0, 0, 0, 0, 0);
             return true;
         }
 
-        var baseAddress = word0 | ((ulong)(word1 & 0x0FFFu) << 32);
+        var baseAddress = word0 | ((ulong)(word1 & 0xFFFFu) << 32);
         var stride = (word1 >> 16) & 0x3FFFu;
+        var unifiedFormat = (word3 >> 12) & 0x7Fu;
+        var (dataFormat, numberFormat) =
+            DecodeGfx10BufferFormat(unifiedFormat);
         var sizeBytes = stride == 0
             ? word2
             : (ulong)stride * word2;
-        descriptor = new BufferDescriptor(baseAddress, stride, word2, sizeBytes);
+        descriptor = new BufferDescriptor(baseAddress, stride, word2, sizeBytes, numberFormat, dataFormat);
         return true;
     }
 
+    private static (uint DataFormat, uint NumberFormat)
+        DecodeGfx10BufferFormat(uint format) =>
+        format switch
+        {
+            0 => (0, 0),
+            >= 1 and <= 6 => (1, format - 1),
+            >= 7 and <= 13 => (2, DecodeUnifiedNumber(format - 7, 7)),
+            >= 14 and <= 19 => (3, format - 14),
+            >= 20 and <= 22 => (4, DecodeIntegerOrFloatNumber(format - 20)),
+            >= 23 and <= 29 => (5, DecodeUnifiedNumber(format - 23, 7)),
+            >= 30 and <= 36 => (6, DecodeUnifiedNumber(format - 30, 7)),
+            >= 37 and <= 43 => (7, DecodeUnifiedNumber(format - 37, 7)),
+            >= 44 and <= 49 => (8, format - 44),
+            >= 50 and <= 55 => (9, format - 50),
+            >= 56 and <= 61 => (10, format - 56),
+            >= 62 and <= 64 => (11, DecodeIntegerOrFloatNumber(format - 62)),
+            >= 65 and <= 71 => (12, DecodeUnifiedNumber(format - 65, 7)),
+            >= 72 and <= 74 => (13, DecodeIntegerOrFloatNumber(format - 72)),
+            >= 75 and <= 77 => (14, DecodeIntegerOrFloatNumber(format - 75)),
+            128 => (1, 9),
+            129 => (3, 9),
+            130 => (10, 9),
+            132 => (34, 7),
+            133 => (16, 0),
+            134 => (17, 0),
+            135 => (18, 0),
+            136 => (19, 0),
+            140 => (4, 7),
+            _ => (0, 0),
+        };
+
+    private static uint DecodeUnifiedNumber(uint offset, uint formatCount) =>
+        offset == formatCount - 1 ? 7u : offset;
+
+    private static uint DecodeIntegerOrFloatNumber(uint offset) =>
+        offset switch
+        {
+            0 => 4,
+            1 => 5,
+            _ => 7,
+        };
+
     private static bool TryReadUserDataScalarLoad(
         Gen5ShaderState state,
         Gen5ShaderInstruction instruction,

src/SharpEmu.Libs/Agc/Gen5ShaderTranslator.cs

@@ -4,6 +4,7 @@
 using SharpEmu.HLE;
 using SharpEmu.Libs.VideoOut;
 using System.Buffers.Binary;
+using System.Runtime.CompilerServices;
 using System.Text;
 
 namespace SharpEmu.Libs.Agc;
@@ -13,6 +14,14 @@ internal static class Gen5ShaderTranslator
     private const int MaxInstructions = 4096;
     private const int MinimumUserDataDwords = 16;
     private const int MaximumUserDataDwords = 256;
+    private static readonly ConditionalWeakTable<object, ShaderDecodeCache> _decodeCaches = new();
+
+    private sealed class ShaderDecodeCache
+    {
+        public object Gate { get; } = new();
+        public Dictionary<ulong, Gen5ShaderProgram> Programs { get; } = new();
+        public Dictionary<ulong, Gen5ShaderMetadata?> Metadata { get; } = new();
+    }
 
     private static readonly uint[] FullscreenBarycentricEs =
     [
@@ -117,18 +126,53 @@ internal static class Gen5ShaderTranslator
         uint userDataScalarRegisterBase = 0)
     {
         state = default!;
-        if (!TryDecodeProgram(ctx, shaderAddress, out var program, out error))
+        error = string.Empty;
+        var cache = _decodeCaches.GetValue(ctx.Memory, static _ => new ShaderDecodeCache());
+        Gen5ShaderProgram? program;
+        lock (cache.Gate)
+        {
+            cache.Programs.TryGetValue(shaderAddress, out program);
+        }
+
+        if (program is null)
+        {
+            if (!TryDecodeProgram(ctx, shaderAddress, out program, out error))
             {
                 return false;
             }
 
+            lock (cache.Gate)
+            {
+                cache.Programs.TryAdd(shaderAddress, program);
+            }
+        }
+
         Gen5ShaderMetadata? metadata = null;
-        if (shaderHeaderAddress != 0 &&
+        if (shaderHeaderAddress != 0)
-            Gen5ShaderMetadataReader.TryRead(ctx, shaderHeaderAddress, out var decodedMetadata))
+        {
+            var metadataCached = false;
+            lock (cache.Gate)
+            {
+                metadataCached = cache.Metadata.TryGetValue(shaderHeaderAddress, out metadata);
+            }
+
+            if (!metadataCached)
+            {
+                if (Gen5ShaderMetadataReader.TryRead(
+                        ctx,
+                        shaderHeaderAddress,
+                        out var decodedMetadata))
                 {
                     metadata = decodedMetadata;
                 }
 
+                lock (cache.Gate)
+                {
+                    cache.Metadata.TryAdd(shaderHeaderAddress, metadata);
+                }
+            }
+        }
+
         var userData = new uint[GetUserDataDwordCount(metadata)];
         for (uint index = 0; index < userData.Length; index++)
         {
@@ -452,6 +496,7 @@ internal static class Gen5ShaderTranslator
             0x2A => "SNorSaveexecB64",
             0x2B => "SXnorSaveexecB64",
             0x37 => "SAndn1SaveexecB64",
+            0x38 => "SOrn1SaveexecB64",
             _ => string.Empty,
         };
 

src/SharpEmu.Libs/Agc/Gen5SpirvTranslator.Alu.cs

@@ -212,12 +212,26 @@ internal static partial class Gen5SpirvTranslator
                 case "VSinF32":
                     result = EmitFloatResult(
                         instruction,
-                        Ext(13, _floatType, GetFloatSource(instruction, 0)));
+                        Ext(
+                            13,
+                            _floatType,
+                            _module.AddInstruction(
+                                SpirvOp.FMul,
+                                _floatType,
+                                GetFloatSource(instruction, 0),
+                                Float(MathF.Tau))));
                     break;
                 case "VCosF32":
                     result = EmitFloatResult(
                         instruction,
-                        Ext(14, _floatType, GetFloatSource(instruction, 0)));
+                        Ext(
+                            14,
+                            _floatType,
+                            _module.AddInstruction(
+                                SpirvOp.FMul,
+                                _floatType,
+                                GetFloatSource(instruction, 0),
+                                Float(MathF.Tau))));
                     break;
                 case "VAddF32":
                     result = EmitFloatBinary(instruction, SpirvOp.FAdd);
@@ -635,13 +649,29 @@ internal static partial class Gen5SpirvTranslator
                         width);
                     break;
                 }
+                case "VBfiB32":
+                {
+                    var mask = GetRawSource(instruction, 0);
+                    var insert = GetRawSource(instruction, 1);
+                    var source = GetRawSource(instruction, 2);
+                    result = _module.AddInstruction(
+                        SpirvOp.BitwiseOr,
+                        _uintType,
+                        BitwiseAnd(mask, insert),
+                        BitwiseAnd(
+                            _module.AddInstruction(SpirvOp.Not, _uintType, mask),
+                            source));
+                    break;
+                }
                 case "VCvtPkrtzF16F32":
                 {
+                    var first = TruncateFloat32ForPack(GetFloatSource(instruction, 0));
+                    var second = TruncateFloat32ForPack(GetFloatSource(instruction, 1));
                     var vector = _module.AddInstruction(
                         SpirvOp.CompositeConstruct,
                         _vec2Type,
-                        GetFloatSource(instruction, 0),
+                        first,
-                        GetFloatSource(instruction, 1));
+                        second);
                     result = Ext(58, _uintType, vector);
                     break;
                 }
@@ -945,6 +975,16 @@ internal static partial class Gen5SpirvTranslator
                     StoreS(destination, result);
                     Store(_scc, IsNotZero(result));
                     return true;
+                case "SBitset1B32":
+                    result = _module.AddInstruction(
+                        SpirvOp.BitFieldInsert,
+                        _uintType,
+                        LoadS(destination),
+                        UInt(1),
+                        BitwiseAnd(left, UInt(31)),
+                        UInt(1));
+                    StoreS(destination, result);
+                    return true;
                 default:
                 {
                     if (instruction.Sources.Count < 2)
@@ -971,13 +1011,14 @@ internal static partial class Gen5SpirvTranslator
                                 left,
                                 right);
                             Store(_scc, _module.AddInstruction(
-                                SpirvOp.UGreaterThanEqual,
+                                SpirvOp.UGreaterThan,
                                 _boolType,
-                                left,
+                                right,
-                                right));
+                                left));
                             break;
                         case "SAddI32":
                             result = IAdd(left, right);
+                            Store(_scc, SignedAddOverflow(left, right, result));
                             break;
                         case "SSubI32":
                             result = _module.AddInstruction(
@@ -985,6 +1026,7 @@ internal static partial class Gen5SpirvTranslator
                                 _uintType,
                                 left,
                                 right);
+                            Store(_scc, SignedSubOverflow(left, right, result));
                             break;
                         case "SAddcU32":
                         {
@@ -1021,8 +1063,8 @@ internal static partial class Gen5SpirvTranslator
                                 SpirvOp.Select,
                                 _uintType,
                                 Load(_boolType, _scc),
-                                UInt(0),
+                                UInt(1),
-                                UInt(1));
+                                UInt(0));
                             var partial = _module.AddInstruction(
                                 SpirvOp.ISub,
                                 _uintType,
@@ -1033,23 +1075,31 @@ internal static partial class Gen5SpirvTranslator
                                 _uintType,
                                 partial,
                                 borrow);
-                            var firstNoBorrow = _module.AddInstruction(
+                            var firstBorrow = _module.AddInstruction(
-                                SpirvOp.UGreaterThanEqual,
+                                SpirvOp.UGreaterThan,
                                 _boolType,
-                                left,
+                                right,
-                                right);
+                                left);
-                            var secondNoBorrow = _module.AddInstruction(
+                            var secondBorrow = _module.AddInstruction(
-                                SpirvOp.UGreaterThanEqual,
+                                SpirvOp.LogicalAnd,
                                 _boolType,
-                                partial,
+                                _module.AddInstruction(
-                                borrow);
+                                    SpirvOp.IEqual,
+                                    _boolType,
+                                    borrow,
+                                    UInt(1)),
+                                _module.AddInstruction(
+                                    SpirvOp.IEqual,
+                                    _boolType,
+                                    right,
+                                    left));
                             Store(
                                 _scc,
                                 _module.AddInstruction(
-                                    SpirvOp.LogicalAnd,
+                                    SpirvOp.LogicalOr,
                                     _boolType,
-                                    firstNoBorrow,
+                                    firstBorrow,
-                                    secondNoBorrow));
+                                    secondBorrow));
                             break;
                         }
                         case "SMulI32":
@@ -1061,6 +1111,7 @@ internal static partial class Gen5SpirvTranslator
                             break;
                         case "SAndB32":
                             result = BitwiseAnd(left, right);
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SOrB32":
                             result = _module.AddInstruction(
@@ -1068,6 +1119,7 @@ internal static partial class Gen5SpirvTranslator
                                 _uintType,
                                 left,
                                 right);
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SXorB32":
                             result = _module.AddInstruction(
@@ -1075,22 +1127,64 @@ internal static partial class Gen5SpirvTranslator
                                 _uintType,
                                 left,
                                 right);
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SAndn2B32":
                             result = BitwiseAnd(
                                 left,
                                 _module.AddInstruction(SpirvOp.Not, _uintType, right));
+                            Store(_scc, IsNotZero(result));
+                            break;
+                        case "SOrn2B32":
+                            result = _module.AddInstruction(
+                                SpirvOp.BitwiseOr,
+                                _uintType,
+                                left,
+                                _module.AddInstruction(SpirvOp.Not, _uintType, right));
+                            Store(_scc, IsNotZero(result));
+                            break;
+                        case "SNandB32":
+                            result = _module.AddInstruction(
+                                SpirvOp.Not,
+                                _uintType,
+                                BitwiseAnd(left, right));
+                            Store(_scc, IsNotZero(result));
+                            break;
+                        case "SNorB32":
+                            result = _module.AddInstruction(
+                                SpirvOp.Not,
+                                _uintType,
+                                _module.AddInstruction(
+                                    SpirvOp.BitwiseOr,
+                                    _uintType,
+                                    left,
+                                    right));
+                            Store(_scc, IsNotZero(result));
+                            break;
+                        case "SXnorB32":
+                            result = _module.AddInstruction(
+                                SpirvOp.Not,
+                                _uintType,
+                                _module.AddInstruction(
+                                    SpirvOp.BitwiseXor,
+                                    _uintType,
+                                    left,
+                                    right));
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SLshlB32":
                             result = ShiftLeftLogical(left, right);
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SLshrB32":
                             result = ShiftRightLogical(
                                 left,
                                 BitwiseAnd(right, UInt(31)));
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SAshrI32":
                             result = ShiftRightArithmetic(left, right);
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SBfmB32":
                             result = _module.AddInstruction(
@@ -1133,6 +1227,7 @@ internal static partial class Gen5SpirvTranslator
                                     left,
                                     offset,
                                     width);
+                            Store(_scc, IsNotZero(result));
                             break;
                         }
                         case "SCselectB32":
@@ -1145,9 +1240,47 @@ internal static partial class Gen5SpirvTranslator
                             break;
                         case "SMinU32":
                             result = Ext(38, _uintType, left, right);
+                            Store(
+                                _scc,
+                                _module.AddInstruction(
+                                    SpirvOp.ULessThan,
+                                    _boolType,
+                                    left,
+                                    right));
+                            break;
+                        case "SMinI32":
+                            result = Bitcast(
+                                _uintType,
+                                Ext(39, _intType, Bitcast(_intType, left), Bitcast(_intType, right)));
+                            Store(
+                                _scc,
+                                _module.AddInstruction(
+                                    SpirvOp.SLessThan,
+                                    _boolType,
+                                    Bitcast(_intType, left),
+                                    Bitcast(_intType, right)));
                             break;
                         case "SMaxU32":
                             result = Ext(41, _uintType, left, right);
+                            Store(
+                                _scc,
+                                _module.AddInstruction(
+                                    SpirvOp.UGreaterThan,
+                                    _boolType,
+                                    left,
+                                    right));
+                            break;
+                        case "SMaxI32":
+                            result = Bitcast(
+                                _uintType,
+                                Ext(42, _intType, Bitcast(_intType, left), Bitcast(_intType, right)));
+                            Store(
+                                _scc,
+                                _module.AddInstruction(
+                                    SpirvOp.SGreaterThan,
+                                    _boolType,
+                                    Bitcast(_intType, left),
+                                    Bitcast(_intType, right)));
                             break;
                         case "SLshl1AddU32":
                         case "SLshl2AddU32":
@@ -1292,17 +1425,55 @@ internal static partial class Gen5SpirvTranslator
                     "SXorSaveexecB64" => _module.AddInstruction(
                         SpirvOp.BitwiseXor, _ulongType, oldExec, left),
                     "SAndn2SaveexecB64" => _module.AddInstruction(
-                        SpirvOp.BitwiseAnd, _ulongType, oldExec, notLeft),
-                    "SAndn1SaveexecB64" => _module.AddInstruction(
                         SpirvOp.BitwiseAnd,
                         _ulongType,
+                        left,
                         _module.AddInstruction(
                             SpirvOp.Not,
                             _ulongType,
+                            oldExec)),
+                    "SAndn1SaveexecB64" => _module.AddInstruction(
+                        SpirvOp.BitwiseAnd,
+                        _ulongType,
+                        notLeft,
+                        oldExec),
+                    "SOrn1SaveexecB64" => _module.AddInstruction(
+                        SpirvOp.BitwiseOr,
+                        _ulongType,
+                        notLeft,
                         oldExec),
-                        left),
                     "SOrn2SaveexecB64" => _module.AddInstruction(
-                        SpirvOp.BitwiseOr, _ulongType, oldExec, notLeft),
+                        SpirvOp.BitwiseOr,
+                        _ulongType,
+                        left,
+                        _module.AddInstruction(
+                            SpirvOp.Not,
+                            _ulongType,
+                            oldExec)),
+                    "SNandSaveexecB64" => _module.AddInstruction(
+                        SpirvOp.Not,
+                        _ulongType,
+                        _module.AddInstruction(
+                            SpirvOp.BitwiseAnd,
+                            _ulongType,
+                            left,
+                            oldExec)),
+                    "SNorSaveexecB64" => _module.AddInstruction(
+                        SpirvOp.Not,
+                        _ulongType,
+                        _module.AddInstruction(
+                            SpirvOp.BitwiseOr,
+                            _ulongType,
+                            left,
+                            oldExec)),
+                    "SXnorSaveexecB64" => _module.AddInstruction(
+                        SpirvOp.Not,
+                        _ulongType,
+                        _module.AddInstruction(
+                            SpirvOp.BitwiseXor,
+                            _ulongType,
+                            left,
+                            oldExec)),
                     _ => 0u,
                 };
                 if (newExec == 0)
@@ -1508,6 +1679,22 @@ internal static partial class Gen5SpirvTranslator
             }
 
             StoreS64(destination, value);
+            if (instruction.Opcode is
+                "SNotB64" or
+                "SAndB64" or
+                "SOrB64" or
+                "SXorB64" or
+                "SAndn1B64" or
+                "SAndn2B64" or
+                "SOrn1B64" or
+                "SOrn2B64" or
+                "SNandB64" or
+                "SNorB64" or
+                "SXnorB64")
+            {
+                Store(_scc, IsNotZero64(value));
+            }
+
             return true;
         }
 
@@ -2067,6 +2254,14 @@ internal static partial class Gen5SpirvTranslator
             return Bitcast(_uintType, value);
         }
 
+        private uint TruncateFloat32ForPack(uint value)
+        {
+            var raw = BitwiseAnd(
+                Bitcast(_uintType, value),
+                UInt(0xFFFF_E000));
+            return Bitcast(_floatType, raw);
+        }
+
         private uint Ext(uint operation, uint resultType, params uint[] operands)
         {
             var values = new uint[2 + operands.Length];
@@ -2086,6 +2281,53 @@ internal static partial class Gen5SpirvTranslator
                 value,
                 _module.Constant64(_ulongType, 0));
 
+        private uint SignBit(uint value) =>
+            ShiftRightLogical(value, UInt(31));
+
+        private uint SignedAddOverflow(uint left, uint right, uint result)
+        {
+            var leftSign = SignBit(left);
+            var rightSign = SignBit(right);
+            var resultSign = SignBit(result);
+            var sameSourceSign = _module.AddInstruction(
+                SpirvOp.IEqual,
+                _boolType,
+                leftSign,
+                rightSign);
+            var resultSignChanged = _module.AddInstruction(
+                SpirvOp.INotEqual,
+                _boolType,
+                leftSign,
+                resultSign);
+            return _module.AddInstruction(
+                SpirvOp.LogicalAnd,
+                _boolType,
+                sameSourceSign,
+                resultSignChanged);
+        }
+
+        private uint SignedSubOverflow(uint left, uint right, uint result)
+        {
+            var leftSign = SignBit(left);
+            var rightSign = SignBit(right);
+            var resultSign = SignBit(result);
+            var differentSourceSign = _module.AddInstruction(
+                SpirvOp.INotEqual,
+                _boolType,
+                leftSign,
+                rightSign);
+            var resultSignChanged = _module.AddInstruction(
+                SpirvOp.INotEqual,
+                _boolType,
+                leftSign,
+                resultSign);
+            return _module.AddInstruction(
+                SpirvOp.LogicalAnd,
+                _boolType,
+                differentSourceSign,
+                resultSignChanged);
+        }
+
         private static bool TryDecodeInlineConstant(uint encoded, out uint value)
         {
             if (encoded == 125)

src/SharpEmu.Libs/Agc/Gen5SpirvTranslator.cs

@@ -467,9 +467,6 @@ internal static partial class Gen5SpirvTranslator
                 _imageBindingByPc.TryAdd(binding.Pc, index);
                 var isStorage =
                     Gen5ShaderTranslator.IsStorageImageOperation(binding.Opcode);
-                var isDepth =
-                    binding.Opcode.Contains("SampleC", StringComparison.Ordinal) ||
-                    binding.Opcode.Contains("Gather4C", StringComparison.Ordinal);
                 var (format, componentKind) =
                     DecodeImageFormat(binding.ResourceDescriptor);
                 var componentType = componentKind switch
@@ -494,7 +491,7 @@ internal static partial class Gen5SpirvTranslator
                 var imageType = _module.TypeImage(
                     componentType,
                     SpirvImageDim.Dim2D,
-                    depth: isDepth,
+                    depth: false,
                     arrayed: false,
                     multisampled: false,
                     sampled: isStorage ? 2u : 1u,
@@ -1661,18 +1658,14 @@ internal static partial class Gen5SpirvTranslator
                 var offset = hasOffset ? BuildImageOffset(image, 0) : 0u;
                 var imageOperands =
                     (explicitLod ? 2u : 0u) | (hasOffset ? 0x10u : 0u);
+                var reference = hasCompare
+                    ? Bitcast(_floatType, LoadV(image.GetAddressRegister(hasOffset ? 1 : 0)))
+                    : 0u;
                 var operands = new List<uint>
                 {
                     imageObject,
                     coordinates,
                 };
-                if (hasCompare)
-                {
-                    operands.Add(
-                        Bitcast(
-                            _floatType,
-                            LoadV(image.GetAddressRegister(hasOffset ? 1 : 0))));
-                }
 
                 if (imageOperands != 0)
                 {
@@ -1689,29 +1682,14 @@ internal static partial class Gen5SpirvTranslator
                 }
 
                 sampled = _module.AddInstruction(
-                    hasCompare
+                    explicitLod
-                        ? explicitLod
-                            ? SpirvOp.ImageSampleDrefExplicitLod
-                            : SpirvOp.ImageSampleDrefImplicitLod
-                        : explicitLod
                         ? SpirvOp.ImageSampleExplicitLod
                         : SpirvOp.ImageSampleImplicitLod,
-                    hasCompare ? resource.ComponentType : resource.VectorType,
+                    resource.VectorType,
                     [.. operands]);
                 if (hasCompare)
                 {
-                    var scalar = sampled;
+                    sampled = EmitManualDepthCompare(resource, sampled, reference);
-                    sampled = _module.AddInstruction(
-                        SpirvOp.CompositeConstruct,
-                        resource.VectorType,
-                        scalar,
-                        scalar,
-                        scalar,
-                        resource.ComponentKind == ImageComponentKind.Float
-                            ? Float(1)
-                            : resource.ComponentKind == ImageComponentKind.Uint
-                                ? UInt(1)
-                                : _module.Constant(_intType, 1));
                 }
             }
             else if (instruction.Opcode.StartsWith(
@@ -1725,6 +1703,9 @@ internal static partial class Gen5SpirvTranslator
                 var start = (hasOffset ? 1 : 0) + (hasCompare ? 1 : 0);
                 var coordinates = BuildFloatCoordinates(image, start);
                 var offset = hasOffset ? BuildImageOffset(image, 0) : 0u;
+                var reference = hasCompare
+                    ? Bitcast(_floatType, LoadV(image.GetAddressRegister(hasOffset ? 1 : 0)))
+                    : 0u;
                 var operands = new List<uint>
                 {
                     imageObject,
@@ -1732,10 +1713,7 @@ internal static partial class Gen5SpirvTranslator
                 };
                 if (hasCompare)
                 {
-                    operands.Add(
+                    operands.Add(UInt(0));
-                        Bitcast(
-                            _floatType,
-                            LoadV(image.GetAddressRegister(hasOffset ? 1 : 0))));
                 }
                 else
                 {
@@ -1756,11 +1734,28 @@ internal static partial class Gen5SpirvTranslator
                 }
 
                 sampled = _module.AddInstruction(
-                    hasCompare
+                    SpirvOp.ImageGather,
-                        ? SpirvOp.ImageDrefGather
-                        : SpirvOp.ImageGather,
                     resource.VectorType,
                     [.. operands]);
+                if (hasCompare)
+                {
+                    var compared = new uint[4];
+                    for (var component = 0u; component < 4; component++)
+                    {
+                        var texel = _module.AddInstruction(
+                            SpirvOp.CompositeExtract,
+                            resource.ComponentType,
+                            sampled,
+                            component);
+                        compared[component] = EmitDepthCompareScalar(resource, texel, reference);
+                    }
+
+                    sampled = _module.AddInstruction(
+                        SpirvOp.CompositeConstruct,
+                        resource.VectorType,
+                        compared);
+                }
+
                 writeAllComponents = true;
             }
             else
@@ -1794,6 +1789,67 @@ internal static partial class Gen5SpirvTranslator
             return true;
         }
 
+        private uint EmitDepthCompareScalar(
+            SpirvImageResource resource,
+            uint texel,
+            uint reference)
+        {
+            var texelAsFloat = resource.ComponentKind switch
+            {
+                ImageComponentKind.Uint => _module.AddInstruction(
+                    SpirvOp.ConvertUToF, _floatType, texel),
+                ImageComponentKind.Sint => _module.AddInstruction(
+                    SpirvOp.ConvertSToF, _floatType, texel),
+                _ => texel,
+            };
+            var passes = _module.AddInstruction(
+                SpirvOp.FOrdLessThanEqual,
+                _boolType,
+                reference,
+                texelAsFloat);
+            return _module.AddInstruction(
+                SpirvOp.Select,
+                resource.ComponentType,
+                passes,
+                resource.ComponentKind switch
+                {
+                    ImageComponentKind.Uint => UInt(1),
+                    ImageComponentKind.Sint => _module.Constant(_intType, 1),
+                    _ => Float(1),
+                },
+                resource.ComponentKind switch
+                {
+                    ImageComponentKind.Uint => UInt(0),
+                    ImageComponentKind.Sint => _module.Constant(_intType, 0),
+                    _ => Float(0),
+                });
+        }
+
+        private uint EmitManualDepthCompare(
+            SpirvImageResource resource,
+            uint sampledVector,
+            uint reference)
+        {
+            var texel = _module.AddInstruction(
+                SpirvOp.CompositeExtract,
+                resource.ComponentType,
+                sampledVector,
+                0u);
+            var scalar = EmitDepthCompareScalar(resource, texel, reference);
+            return _module.AddInstruction(
+                SpirvOp.CompositeConstruct,
+                resource.VectorType,
+                scalar,
+                scalar,
+                scalar,
+                resource.ComponentKind switch
+                {
+                    ImageComponentKind.Uint => UInt(1),
+                    ImageComponentKind.Sint => _module.Constant(_intType, 1),
+                    _ => Float(1),
+                });
+        }
+
         private uint BuildFloatCoordinates(Gen5ImageControl image, int start)
         {
             var x = Bitcast(

src/SharpEmu.Libs/Ampr/AmprExports.cs

@@ -24,6 +24,7 @@ public static class AmprExports
     private const uint KernelEventQueueRecordType = 2;
     private const uint WriteAddressRecordType = 3;
     private static readonly ConcurrentDictionary<ulong, CommandBufferState> _commandBuffers = new();
+    private static readonly ConcurrentDictionary<string, Lazy<CachedHostFile>> _hostFileCache = new(StringComparer.OrdinalIgnoreCase);
     private static readonly bool _traceAmpr =
         string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_AMPR"), "1", StringComparison.Ordinal);
     private static readonly bool _traceAmprReads =
@@ -37,6 +38,23 @@ public static class AmprExports
         public ulong WriteOffset;
     }
 
+    private sealed class CachedHostFile
+    {
+        public CachedHostFile(string path)
+        {
+            Stream = new FileStream(
+                path,
+                FileMode.Open,
+                FileAccess.Read,
+                FileShare.ReadWrite | FileShare.Delete,
+                bufferSize: 1024 * 1024,
+                FileOptions.RandomAccess);
+        }
+
+        public object Gate { get; } = new();
+        public FileStream Stream { get; }
+    }
+
     [SysAbiExport(
         Nid = "8aI7R7WaOlc",
         ExportName = "sceAmprCommandBufferConstructor",
@@ -249,7 +267,7 @@ public static class AmprExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        if (!AmprFileRegistry.TryGetHostPath(fileId, out var hostPath) || !File.Exists(hostPath))
+        if (!AmprFileRegistry.TryGetHostPath(fileId, out var hostPath))
         {
             TraceAmprRead(ctx, commandBuffer, fileId, destination, size, fileOffset, bytesRead: 0, hostPath, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
@@ -634,24 +652,43 @@ public static class AmprExports
 
         try
         {
-            using var stream = new FileStream(
+            if (!TryGetCachedHostFile(hostPath, out var cachedFile, out var openResult))
-                hostPath,
+            {
-                FileMode.Open,
+                return openResult;
-                FileAccess.Read,
+            }
-                FileShare.ReadWrite | FileShare.Delete,
+
-                ChunkSize,
+            long fileLength;
-                FileOptions.SequentialScan);
+            lock (cachedFile.Gate)
-            if (fileOffset >= (ulong)stream.Length)
+            {
+                fileLength = cachedFile.Stream.Length;
+            }
+
+            if (fileOffset >= (ulong)fileLength)
             {
                 return (int)OrbisGen2Result.ORBIS_GEN2_OK;
             }
 
-            stream.Position = unchecked((long)fileOffset);
-
             while (bytesRead < size)
             {
+                if (bytesRead > ulong.MaxValue - fileOffset)
+                {
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+                }
+
+                var absoluteOffset = fileOffset + bytesRead;
+                if (absoluteOffset > long.MaxValue)
+                {
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+                }
+
                 var request = (int)Math.Min((ulong)buffer.Length, size - bytesRead);
-                var read = stream.Read(buffer, 0, request);
+                int read;
+                lock (cachedFile.Gate)
+                {
+                    cachedFile.Stream.Position = unchecked((long)absoluteOffset);
+                    read = cachedFile.Stream.Read(buffer, 0, request);
+                }
+
                 if (read <= 0)
                 {
                     break;
@@ -681,6 +718,44 @@ public static class AmprExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    private static bool TryGetCachedHostFile(string hostPath, out CachedHostFile file, out int result)
+    {
+        file = null!;
+        result = (int)OrbisGen2Result.ORBIS_GEN2_OK;
+
+        string cachePath;
+        try
+        {
+            cachePath = Path.GetFullPath(hostPath);
+        }
+        catch
+        {
+            cachePath = hostPath;
+        }
+
+        var lazy = _hostFileCache.GetOrAdd(
+            cachePath,
+            static path => new Lazy<CachedHostFile>(() => new CachedHostFile(path), isThreadSafe: true));
+
+        try
+        {
+            file = lazy.Value;
+            return true;
+        }
+        catch (UnauthorizedAccessException)
+        {
+            _hostFileCache.TryRemove(cachePath, out _);
+            result = (int)OrbisGen2Result.ORBIS_GEN2_ERROR_PERMISSION_DENIED;
+            return false;
+        }
+        catch (IOException)
+        {
+            _hostFileCache.TryRemove(cachePath, out _);
+            result = (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            return false;
+        }
+    }
+
     private static bool AppendReadFileRecord(
         CpuContext ctx,
         ulong commandBuffer,

src/SharpEmu.Libs/Audio/AudioOutExports.cs

@@ -0,0 +1,242 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Buffers;
+using System.Collections.Concurrent;
+using System.Diagnostics;
+using System.Threading;
+
+namespace SharpEmu.Libs.Audio;
+
+public static class AudioOutExports
+{
+    private static readonly ConcurrentDictionary<int, PortState> Ports = new();
+    private static int _nextPortHandle;
+
+    private sealed class PortState : IDisposable
+    {
+        private readonly object _paceGate = new();
+        private long _nextSilentOutput;
+
+        public PortState(
+            int userId,
+            int type,
+            uint bufferLength,
+            uint frequency,
+            int format,
+            int channels,
+            int bytesPerSample,
+            bool isFloat,
+            WinMmAudioPort? backend)
+        {
+            UserId = userId;
+            Type = type;
+            BufferLength = bufferLength;
+            Frequency = frequency;
+            Format = format;
+            Channels = channels;
+            BytesPerSample = bytesPerSample;
+            IsFloat = isFloat;
+            Backend = backend;
+        }
+
+        public int UserId { get; }
+        public int Type { get; }
+        public uint BufferLength { get; }
+        public uint Frequency { get; }
+        public int Format { get; }
+        public int Channels { get; }
+        public int BytesPerSample { get; }
+        public bool IsFloat { get; }
+        public WinMmAudioPort? Backend { get; }
+        public int BufferByteLength =>
+            checked((int)BufferLength * Channels * BytesPerSample);
+
+        public void PaceSilence()
+        {
+            long delay;
+            lock (_paceGate)
+            {
+                var now = Stopwatch.GetTimestamp();
+                if (_nextSilentOutput < now)
+                {
+                    _nextSilentOutput = now;
+                }
+
+                delay = _nextSilentOutput - now;
+                _nextSilentOutput += checked(
+                    (long)Math.Ceiling(
+                        Stopwatch.Frequency * (double)BufferLength / Frequency));
+            }
+
+            if (delay > 0)
+            {
+                Thread.Sleep(TimeSpan.FromSeconds((double)delay / Stopwatch.Frequency));
+            }
+        }
+
+        public void Dispose() => Backend?.Dispose();
+    }
+
+    [SysAbiExport(
+        Nid = "JfEPXVxhFqA",
+        ExportName = "sceAudioOutInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAudioOut")]
+    public static int AudioOutInit(CpuContext ctx) => SetReturn(ctx, 0);
+
+    [SysAbiExport(
+        Nid = "ekNvsT22rsY",
+        ExportName = "sceAudioOutOpen",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAudioOut")]
+    public static int AudioOutOpen(CpuContext ctx)
+    {
+        var userId = unchecked((int)ctx[CpuRegister.Rdi]);
+        var type = unchecked((int)ctx[CpuRegister.Rsi]);
+        var bufferLength = unchecked((uint)ctx[CpuRegister.Rcx]);
+        var frequency = unchecked((uint)ctx[CpuRegister.R8]);
+        var format = unchecked((int)ctx[CpuRegister.R9]);
+        if (bufferLength == 0 || frequency == 0 ||
+            !TryGetFormat(format, out var channels, out var bytesPerSample, out var isFloat))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        WinMmAudioPort? backend = null;
+        string backendName;
+        try
+        {
+            backend = new WinMmAudioPort(frequency);
+            backendName = "winmm";
+        }
+        catch (Exception exception)
+        {
+            backendName = "silent";
+            Console.Error.WriteLine(
+                $"[LOADER][WARN] AudioOut host backend unavailable: {exception.Message}");
+        }
+
+        var handle = Interlocked.Increment(ref _nextPortHandle);
+        Ports[handle] = new PortState(
+            userId,
+            type,
+            bufferLength,
+            frequency,
+            format,
+            channels,
+            bytesPerSample,
+            isFloat,
+            backend);
+        Console.Error.WriteLine(
+            $"[LOADER][INFO] AudioOut port {handle}: {frequency} Hz, " +
+            $"{channels} ch, {(isFloat ? "float32" : "s16")}, " +
+            $"{bufferLength} frames, backend={backendName}");
+        return SetReturn(ctx, handle);
+    }
+
+    [SysAbiExport(
+        Nid = "s1--uE9mBFw",
+        ExportName = "sceAudioOutClose",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAudioOut")]
+    public static int AudioOutClose(CpuContext ctx)
+    {
+        var handle = unchecked((int)ctx[CpuRegister.Rdi]);
+        if (!Ports.TryRemove(handle, out var port))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        port.Dispose();
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "QOQtbeDqsT4",
+        ExportName = "sceAudioOutOutput",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAudioOut")]
+    public static int AudioOutOutput(CpuContext ctx)
+    {
+        var handle = unchecked((int)ctx[CpuRegister.Rdi]);
+        var sourceAddress = ctx[CpuRegister.Rsi];
+        if (!Ports.TryGetValue(handle, out var port))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (sourceAddress == 0)
+        {
+            return SetReturn(ctx, 0);
+        }
+
+        var buffer = ArrayPool<byte>.Shared.Rent(port.BufferByteLength);
+        try
+        {
+            var source = buffer.AsSpan(0, port.BufferByteLength);
+            if (!ctx.Memory.TryRead(sourceAddress, source))
+            {
+                return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            if (port.Backend is null ||
+                !port.Backend.Submit(
+                    source,
+                    port.BufferLength,
+                    port.Channels,
+                    port.BytesPerSample,
+                    port.IsFloat))
+            {
+                port.PaceSilence();
+            }
+
+            return SetReturn(ctx, 0);
+        }
+        finally
+        {
+            ArrayPool<byte>.Shared.Return(buffer);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "b+uAV89IlxE",
+        ExportName = "sceAudioOutSetVolume",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAudioOut")]
+    public static int AudioOutSetVolume(CpuContext ctx)
+    {
+        var handle = unchecked((int)ctx[CpuRegister.Rdi]);
+        return SetReturn(
+            ctx,
+            Ports.ContainsKey(handle)
+                ? 0
+                : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+
+    private static bool TryGetFormat(
+        int rawFormat,
+        out int channels,
+        out int bytesPerSample,
+        out bool isFloat)
+    {
+        var format = rawFormat & 0xFF;
+        channels = format switch
+        {
+            0 or 3 => 1,
+            1 or 4 => 2,
+            2 or 5 or 6 or 7 => 8,
+            _ => 0,
+        };
+        bytesPerSample = format is >= 3 and <= 5 or 7 ? 4 : 2;
+        isFloat = bytesPerSample == 4;
+        return channels != 0;
+    }
+}

src/SharpEmu.Libs/Audio/WinMmAudioPort.cs

@@ -0,0 +1,302 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers;
+using System.Buffers.Binary;
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.Libs.Audio;
+
+internal sealed class WinMmAudioPort : IDisposable
+{
+    private const uint WaveMapper = uint.MaxValue;
+    private const uint CallbackEvent = 0x0005_0000;
+    private const ushort WaveFormatPcm = 1;
+    private const uint WaveHeaderDone = 0x0000_0001;
+    private const int MaximumQueuedPcmBytes = 32 * 1024;
+
+    private readonly object _gate = new();
+    private readonly AutoResetEvent _completion = new(false);
+    private readonly Queue<NativeBuffer> _buffers = new();
+    private IntPtr _device;
+    private int _queuedPcmBytes;
+    private bool _disposed;
+
+    public WinMmAudioPort(uint sampleRate)
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            throw new PlatformNotSupportedException("WinMM audio is only available on Windows.");
+        }
+
+        var format = new WaveFormat
+        {
+            FormatTag = WaveFormatPcm,
+            Channels = 2,
+            SamplesPerSecond = sampleRate,
+            AverageBytesPerSecond = checked(sampleRate * 4),
+            BlockAlign = 4,
+            BitsPerSample = 16,
+            ExtraSize = 0,
+        };
+        var result = WaveOutOpen(
+            out _device,
+            WaveMapper,
+            ref format,
+            _completion.SafeWaitHandle.DangerousGetHandle(),
+            IntPtr.Zero,
+            CallbackEvent);
+        if (result != 0)
+        {
+            throw new InvalidOperationException($"waveOutOpen failed with MMRESULT {result}.");
+        }
+    }
+
+    public bool Submit(
+        ReadOnlySpan<byte> source,
+        uint frames,
+        int channels,
+        int bytesPerSample,
+        bool isFloat)
+    {
+        lock (_gate)
+        {
+            if (_disposed)
+            {
+                return false;
+            }
+
+            var outputLength = checked((int)frames * 4);
+            ReapCompletedBuffers();
+            while (_queuedPcmBytes != 0 &&
+                   _queuedPcmBytes + outputLength > MaximumQueuedPcmBytes)
+            {
+                if (!_completion.WaitOne(TimeSpan.FromSeconds(1)))
+                {
+                    return false;
+                }
+
+                ReapCompletedBuffers();
+            }
+
+            var output = ArrayPool<byte>.Shared.Rent(outputLength);
+            try
+            {
+                ConvertToStereoPcm16(
+                    source,
+                    output.AsSpan(0, outputLength),
+                    checked((int)frames),
+                    channels,
+                    bytesPerSample,
+                    isFloat);
+                return QueueBuffer(output.AsSpan(0, outputLength));
+            }
+            finally
+            {
+                ArrayPool<byte>.Shared.Return(output);
+            }
+        }
+    }
+
+    public void Dispose()
+    {
+        lock (_gate)
+        {
+            if (_disposed)
+            {
+                return;
+            }
+
+            _disposed = true;
+            if (_device != IntPtr.Zero)
+            {
+                WaveOutReset(_device);
+                while (_buffers.TryDequeue(out var buffer))
+                {
+                    ReleaseBuffer(buffer);
+                }
+
+                WaveOutClose(_device);
+                _device = IntPtr.Zero;
+            }
+
+            _completion.Dispose();
+        }
+    }
+
+    private bool QueueBuffer(ReadOnlySpan<byte> data)
+    {
+        var dataAddress = Marshal.AllocHGlobal(data.Length);
+        var headerAddress = IntPtr.Zero;
+        try
+        {
+            unsafe
+            {
+                data.CopyTo(new Span<byte>((void*)dataAddress, data.Length));
+            }
+
+            var header = new WaveHeader
+            {
+                Data = dataAddress,
+                BufferLength = checked((uint)data.Length),
+            };
+            headerAddress = Marshal.AllocHGlobal(Marshal.SizeOf<WaveHeader>());
+            Marshal.StructureToPtr(header, headerAddress, false);
+
+            var result = WaveOutPrepareHeader(
+                _device,
+                headerAddress,
+                checked((uint)Marshal.SizeOf<WaveHeader>()));
+            if (result != 0)
+            {
+                return false;
+            }
+
+            result = WaveOutWrite(
+                _device,
+                headerAddress,
+                checked((uint)Marshal.SizeOf<WaveHeader>()));
+            if (result != 0)
+            {
+                WaveOutUnprepareHeader(
+                    _device,
+                    headerAddress,
+                    checked((uint)Marshal.SizeOf<WaveHeader>()));
+                return false;
+            }
+
+            _buffers.Enqueue(new NativeBuffer(dataAddress, headerAddress, data.Length));
+            _queuedPcmBytes += data.Length;
+            dataAddress = IntPtr.Zero;
+            headerAddress = IntPtr.Zero;
+            return true;
+        }
+        finally
+        {
+            if (headerAddress != IntPtr.Zero)
+            {
+                Marshal.FreeHGlobal(headerAddress);
+            }
+
+            if (dataAddress != IntPtr.Zero)
+            {
+                Marshal.FreeHGlobal(dataAddress);
+            }
+        }
+    }
+
+    private void ReapCompletedBuffers()
+    {
+        while (_buffers.TryPeek(out var buffer))
+        {
+            var header = Marshal.PtrToStructure<WaveHeader>(buffer.Header);
+            if ((header.Flags & WaveHeaderDone) == 0)
+            {
+                return;
+            }
+
+            _buffers.Dequeue();
+            ReleaseBuffer(buffer);
+        }
+    }
+
+    private void ReleaseBuffer(NativeBuffer buffer)
+    {
+        WaveOutUnprepareHeader(
+            _device,
+            buffer.Header,
+            checked((uint)Marshal.SizeOf<WaveHeader>()));
+        _queuedPcmBytes -= buffer.Length;
+        Marshal.FreeHGlobal(buffer.Header);
+        Marshal.FreeHGlobal(buffer.Data);
+    }
+
+    private static void ConvertToStereoPcm16(
+        ReadOnlySpan<byte> source,
+        Span<byte> destination,
+        int frames,
+        int channels,
+        int bytesPerSample,
+        bool isFloat)
+    {
+        var sourceFrameSize = checked(channels * bytesPerSample);
+        for (var frame = 0; frame < frames; frame++)
+        {
+            var sourceFrame = source.Slice(frame * sourceFrameSize, sourceFrameSize);
+            var left = ReadSample(sourceFrame, 0, bytesPerSample, isFloat);
+            var right = channels == 1
+                ? left
+                : ReadSample(sourceFrame, 1, bytesPerSample, isFloat);
+            BinaryPrimitives.WriteInt16LittleEndian(destination[(frame * 4)..], left);
+            BinaryPrimitives.WriteInt16LittleEndian(destination[((frame * 4) + 2)..], right);
+        }
+    }
+
+    private static short ReadSample(
+        ReadOnlySpan<byte> frame,
+        int channel,
+        int bytesPerSample,
+        bool isFloat)
+    {
+        var sample = frame.Slice(channel * bytesPerSample, bytesPerSample);
+        if (!isFloat)
+        {
+            return BinaryPrimitives.ReadInt16LittleEndian(sample);
+        }
+
+        var bits = BinaryPrimitives.ReadInt32LittleEndian(sample);
+        var value = Math.Clamp(BitConverter.Int32BitsToSingle(bits), -1.0f, 1.0f);
+        return checked((short)MathF.Round(value * short.MaxValue));
+    }
+
+    private readonly record struct NativeBuffer(IntPtr Data, IntPtr Header, int Length);
+
+    [StructLayout(LayoutKind.Sequential, Pack = 2)]
+    private struct WaveFormat
+    {
+        public ushort FormatTag;
+        public ushort Channels;
+        public uint SamplesPerSecond;
+        public uint AverageBytesPerSecond;
+        public ushort BlockAlign;
+        public ushort BitsPerSample;
+        public ushort ExtraSize;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct WaveHeader
+    {
+        public IntPtr Data;
+        public uint BufferLength;
+        public uint BytesRecorded;
+        public nuint User;
+        public uint Flags;
+        public uint Loops;
+        public IntPtr Next;
+        public nuint Reserved;
+    }
+
+    [DllImport("winmm.dll", EntryPoint = "waveOutOpen")]
+    private static extern uint WaveOutOpen(
+        out IntPtr device,
+        uint deviceId,
+        ref WaveFormat format,
+        IntPtr callback,
+        IntPtr instance,
+        uint flags);
+
+    [DllImport("winmm.dll", EntryPoint = "waveOutPrepareHeader")]
+    private static extern uint WaveOutPrepareHeader(IntPtr device, IntPtr header, uint headerSize);
+
+    [DllImport("winmm.dll", EntryPoint = "waveOutWrite")]
+    private static extern uint WaveOutWrite(IntPtr device, IntPtr header, uint headerSize);
+
+    [DllImport("winmm.dll", EntryPoint = "waveOutUnprepareHeader")]
+    private static extern uint WaveOutUnprepareHeader(IntPtr device, IntPtr header, uint headerSize);
+
+    [DllImport("winmm.dll", EntryPoint = "waveOutReset")]
+    private static extern uint WaveOutReset(IntPtr device);
+
+    [DllImport("winmm.dll", EntryPoint = "waveOutClose")]
+    private static extern uint WaveOutClose(IntPtr device);
+}

src/SharpEmu.Libs/AvPlayer/AvPlayerExports.cs

@@ -0,0 +1,77 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using SharpEmu.Libs.Kernel;
+
+namespace SharpEmu.Libs.AvPlayer;
+
+public static class AvPlayerExports
+{
+    private const int InvalidParameters = unchecked((int)0x806A0001);
+    private static readonly object StateGate = new();
+    private static readonly HashSet<ulong> Players = new();
+
+    [SysAbiExport(
+        Nid = "aS66RI0gGgo",
+        ExportName = "sceAvPlayerInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAvPlayer")]
+    public static int AvPlayerInit(CpuContext ctx)
+    {
+        if (ctx[CpuRegister.Rdi] == 0 ||
+            !KernelMemoryCompatExports.TryAllocateHleData(ctx, 0x40, 16, out var handle))
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return 0;
+        }
+
+        lock (StateGate)
+        {
+            Players.Add(handle);
+        }
+
+        ctx[CpuRegister.Rax] = handle;
+        return unchecked((int)handle);
+    }
+
+    [SysAbiExport(
+        Nid = "HD1YKVU26-M",
+        ExportName = "sceAvPlayerPostInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAvPlayer")]
+    public static int AvPlayerPostInit(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var dataAddress = ctx[CpuRegister.Rsi];
+        lock (StateGate)
+        {
+            return SetReturn(
+                ctx,
+                handle != 0 && dataAddress != 0 && Players.Contains(handle)
+                    ? 0
+                    : InvalidParameters);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "NkJwDzKmIlw",
+        ExportName = "sceAvPlayerClose",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAvPlayer")]
+    public static int AvPlayerClose(CpuContext ctx)
+    {
+        lock (StateGate)
+        {
+            return SetReturn(
+                ctx,
+                Players.Remove(ctx[CpuRegister.Rdi]) ? 0 : InvalidParameters);
+        }
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}

src/SharpEmu.Libs/CommonDialog/MsgDialogExports.cs

@@ -0,0 +1,27 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Threading;
+
+namespace SharpEmu.Libs.CommonDialog;
+
+public static class MsgDialogExports
+{
+    private const int AlreadyInitialized = unchecked((int)0x80B80002);
+    private static int _initialized;
+
+    [SysAbiExport(
+        Nid = "lDqxaY1UbEo",
+        ExportName = "sceMsgDialogInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceMsgDialog")]
+    public static int MsgDialogInitialize(CpuContext ctx)
+    {
+        var result = Interlocked.Exchange(ref _initialized, 1) == 0
+            ? 0
+            : AlreadyInitialized;
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}

src/SharpEmu.Libs/Kernel/KernelEventQueueCompatExports.cs

@@ -276,6 +276,22 @@ public static class KernelEventQueueCompatExports
         var outCountAddress = ctx[CpuRegister.Rcx];
         var timeoutAddress = ctx[CpuRegister.R8];
 
+        if (!IsValidEqueue(handle))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
+
+        if (eventsAddress == 0 || eventCapacity < 1)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        uint timeoutUsec = 0;
+        if (timeoutAddress != 0 && !TryReadUInt32(ctx, timeoutAddress, out timeoutUsec))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
         var deliveredCount = DequeueEvents(ctx, handle, eventsAddress, eventCapacity);
         if (outCountAddress != 0 && !TryWriteUInt32(ctx, outCountAddress, (uint)deliveredCount))
         {
@@ -300,6 +316,41 @@ public static class KernelEventQueueCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_OK;
         }
 
+        if (timeoutAddress != 0 && ctx.TryReadUInt64(timeoutAddress, out var timeoutRaw))
+        {
+            var timeoutMicros = timeoutRaw & 0xFFFF_FFFFUL;
+            var deadline = Environment.TickCount64 +
+                Math.Max(1L, (long)Math.Min(timeoutMicros / 1000, int.MaxValue));
+            lock (_eventQueueGate)
+            {
+                while (!HasPendingEvents(handle))
+                {
+                    var remaining = deadline - Environment.TickCount64;
+                    if (remaining <= 0)
+                    {
+                        break;
+                    }
+
+                    Monitor.Wait(_eventQueueGate, (int)Math.Min(remaining, 100));
+                }
+            }
+
+            deliveredCount = DequeueEvents(ctx, handle, eventsAddress, eventCapacity);
+            if (outCountAddress != 0 && !TryWriteUInt32(ctx, outCountAddress, (uint)deliveredCount))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            if (deliveredCount > 0)
+            {
+                TraceEventQueue(ctx, "wait-timed-deliver", handle);
+                return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+            }
+
+            TraceEventQueue(ctx, "wait-timeout", handle);
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT;
+        }
+
         TraceEventQueue(ctx, "wait", handle);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
@@ -330,6 +381,7 @@ public static class KernelEventQueueCompatExports
 
             queue.AddLast(queuedEvent);
             queued = true;
+            Monitor.PulseAll(_eventQueueGate);
         }
 
         if (queued)
@@ -494,7 +546,9 @@ public static class KernelEventQueueCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        return deliveredCount > 0
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT;
     }
 
     private static bool HasPendingEvents(ulong handle)
@@ -612,4 +666,17 @@ public static class KernelEventQueueCompatExports
         BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
         return ctx.Memory.TryWrite(address, buffer);
     }
+
+    private static bool TryReadUInt32(CpuContext ctx, ulong address, out uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+        return true;
+    }
 }

src/SharpEmu.Libs/Kernel/KernelExceptionCompatExports.cs

@@ -0,0 +1,65 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Kernel;
+
+public static class KernelExceptionCompatExports
+{
+    private static readonly HashSet<int> AllowedSignals = new() { 1, 4, 8, 10, 11, 30 };
+    private static readonly Dictionary<int, ulong> _installedHandlers = new();
+    private static readonly object _gate = new();
+
+    [SysAbiExport(
+        Nid = "WkwEd3N7w0Y",
+        ExportName = "sceKernelInstallExceptionHandler",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int InstallExceptionHandler(CpuContext ctx)
+    {
+        var signum = unchecked((int)ctx[CpuRegister.Rdi]);
+        var handler = ctx[CpuRegister.Rsi];
+
+        if (!AllowedSignals.Contains(signum))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        lock (_gate)
+        {
+            if (_installedHandlers.ContainsKey(signum))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_ALREADY_EXISTS;
+            }
+
+            _installedHandlers[signum] = handler;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "Qhv5ARAoOEc",
+        ExportName = "sceKernelRemoveExceptionHandler",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int RemoveExceptionHandler(CpuContext ctx)
+    {
+        var signum = unchecked((int)ctx[CpuRegister.Rdi]);
+
+        if (!AllowedSignals.Contains(signum))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        lock (_gate)
+        {
+            _installedHandlers.Remove(signum);
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+}

src/SharpEmu.Libs/Kernel/KernelExports.cs

@@ -306,10 +306,6 @@ public static class KernelExports
     {
         var threadId = ctx[CpuRegister.Rdi];
         var returnValueAddress = ctx[CpuRegister.Rsi];
-        if (returnValueAddress != 0 && !ctx.TryWriteUInt64(returnValueAddress, 0))
-        {
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
-        }
 
         if (ShouldTracePthread())
         {
@@ -317,6 +313,30 @@ public static class KernelExports
                 $"[LOADER][TRACE] pthread_join: thread=0x{threadId:X16} retval_out=0x{returnValueAddress:X16}");
         }
 
+        var returnValue = 0UL;
+        if (GuestThreadExecution.Scheduler is { } scheduler &&
+            !scheduler.TryJoinThread(ctx, threadId, out returnValue, out var error))
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][ERROR] pthread_join: thread=0x{threadId:X16}: {error}");
+            var result = string.Equals(
+                error,
+                "thread cannot join itself",
+                StringComparison.Ordinal)
+                ? OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT
+                : OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            ctx[CpuRegister.Rax] = unchecked((ulong)(int)result);
+            return (int)result;
+        }
+
+        if (returnValueAddress != 0 &&
+            !ctx.TryWriteUInt64(returnValueAddress, returnValue))
+        {
+            ctx[CpuRegister.Rax] =
+                unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
         ctx[CpuRegister.Rax] = 0;
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
@@ -345,6 +365,13 @@ public static class KernelExports
         LibraryName = "libKernel")]
     public static int KernelOpen(CpuContext ctx) => KernelMemoryCompatExports.KernelOpenUnderscore(ctx);
 
+    [SysAbiExport(
+        Nid = "mqQMh1zPPT8",
+        ExportName = "fstat",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libc")]
+    public static int Fstat(CpuContext ctx) => KernelMemoryCompatExports.KernelFstat(ctx);
+
     [SysAbiExport(
         Nid = "hcuQgD53UxM",
         ExportName = "printf",

src/SharpEmu.Libs/Kernel/KernelMemoryCompatExports.cs

@@ -5,9 +5,9 @@ using SharpEmu.HLE;
 using SharpEmu.Libs.Ampr;
 using System.Buffers;
 using System.Buffers.Binary;
+using System.Collections.Concurrent;
 using System.Text;
 using System.Threading;
-using System.Reflection;
 using System.Runtime.InteropServices;
 using System.Linq;
 using System.Globalization;
@@ -99,12 +99,16 @@ public static class KernelMemoryCompatExports
     private static readonly object _tlsGate = new();
     private static readonly object _ioTraceGate = new();
     private static readonly object _statCacheGate = new();
+    private static readonly object _guestMountGate = new();
     private static readonly Dictionary<ulong, DirectAllocation> _directAllocations = new();
     private static readonly Dictionary<ulong, LibcHeapAllocation> _libcAllocations = new();
     private static readonly Dictionary<ulong, MappedRegion> _mappedRegions = new();
+    private static readonly Dictionary<ulong, string> _mappedRegionNames = new();
     private static readonly Dictionary<ulong, ulong> _tlsModuleBlocks = new();
+    private static readonly Dictionary<string, string> _guestMounts = new(StringComparer.OrdinalIgnoreCase);
     private static readonly HashSet<string> _tracedStatResults = new(StringComparer.Ordinal);
     private static readonly HashSet<string> _negativeStatCache = new(StringComparer.OrdinalIgnoreCase);
+    private static readonly ConcurrentDictionary<string, ulong> _aprFileSizeCache = new(StringComparer.OrdinalIgnoreCase);
     private static long _nextFileDescriptor = 2;
     private static ulong _nextPhysicalAddress;
     private static ulong _nextVirtualAddress;
@@ -153,6 +157,32 @@ public static class KernelMemoryCompatExports
     private readonly record struct MappedRegion(ulong Address, ulong Length, int Protection, bool IsFlexible, bool IsDirect, ulong DirectStart);
     private readonly record struct BatchMapEntry(ulong Start, ulong Offset, ulong Length, byte Protection, byte Type, int Operation);
 
+    public static void RegisterGuestPathMount(string guestMountPoint, string hostRoot)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(guestMountPoint);
+        ArgumentException.ThrowIfNullOrWhiteSpace(hostRoot);
+
+        var normalizedMountPoint = NormalizeGuestStatCachePath(guestMountPoint);
+        if (normalizedMountPoint is null || normalizedMountPoint == "/")
+        {
+            throw new ArgumentException("Guest mount point must name a directory.", nameof(guestMountPoint));
+        }
+
+        var normalizedHostRoot = Path.GetFullPath(hostRoot);
+        Directory.CreateDirectory(normalizedHostRoot);
+        lock (_guestMountGate)
+        {
+            _guestMounts[normalizedMountPoint] = normalizedHostRoot;
+        }
+
+        lock (_statCacheGate)
+        {
+            _negativeStatCache.RemoveWhere(path =>
+                string.Equals(path, normalizedMountPoint, StringComparison.OrdinalIgnoreCase) ||
+                path.StartsWith(normalizedMountPoint + "/", StringComparison.OrdinalIgnoreCase));
+        }
+    }
+
     internal static bool TryAllocateHleData(
         CpuContext ctx,
         ulong length,
@@ -203,6 +233,25 @@ public static class KernelMemoryCompatExports
         return true;
     }
 
+    internal static void RegisterReservedVirtualRange(ulong address, ulong length)
+    {
+        if (address == 0 || length == 0)
+        {
+            return;
+        }
+
+        lock (_memoryGate)
+        {
+            _mappedRegions[address] = new MappedRegion(
+                address,
+                length,
+                Protection: 0,
+                IsFlexible: false,
+                IsDirect: false,
+                DirectStart: 0);
+        }
+    }
+
     [SysAbiExport(
         Nid = "8zTFvBIAIN8",
         ExportName = "memset",
@@ -1294,6 +1343,7 @@ public static class KernelMemoryCompatExports
             if (IsMutatingOpen(flags))
             {
                 InvalidateNegativeStatCacheForPathAndAncestors(guestPath);
+                InvalidateAprFileSizeCache(hostPath);
             }
 
             LogOpenTrace($"_open file path='{guestPath}' host='{hostPath}' flags=0x{flags:X8} fd={fd}");
@@ -1502,6 +1552,7 @@ public static class KernelMemoryCompatExports
 
             File.Delete(hostPath);
             InvalidateNegativeStatCacheForPathAndAncestors(guestPath);
+            InvalidateAprFileSizeCache(hostPath);
             AddNegativeStatCacheForGuestPath(guestPath);
             LogOpenTrace($"unlink path='{guestPath}' host='{hostPath}'");
             ctx[CpuRegister.Rax] = 0;
@@ -2407,6 +2458,36 @@ public static class KernelMemoryCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+    Nid = "hwVSPCmp5tM",
+    ExportName = "sceKernelCheckedReleaseDirectMemory",
+    Target = Generation.Gen4 | Generation.Gen5,
+    LibraryName = "libKernel")]
+    public static int KernelCheckedReleaseDirectMemory(CpuContext ctx)
+    {
+        var start = ctx[CpuRegister.Rdi];
+        var length = ctx[CpuRegister.Rsi];
+
+        if (length == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        lock (_memoryGate)
+        {
+            if (!_directAllocations.TryGetValue(start, out var allocation) ||
+                allocation.Length != length)
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            }
+
+            _directAllocations.Remove(start);
+            _nextPhysicalAddress = GetDirectMemoryHighWaterMarkLocked();
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "L-Q3LEjIbgA",
         ExportName = "sceKernelMapDirectMemory",
@@ -2450,6 +2531,17 @@ public static class KernelMemoryCompatExports
             if (fixedMapping && requestedAddress != 0)
             {
                 mappedAddress = requestedAddress;
+                reserved = IsGuestRangeBacked(ctx, requestedAddress, length);
+                if (!reserved)
+                {
+                    TryReserveExactGuestVirtualRange(ctx, requestedAddress, length, protection);
+                    reserved = IsGuestRangeBacked(ctx, requestedAddress, length);
+                }
+
+                if (!reserved)
+                {
+                    mappedAddress = 0;
+                }
             }
             else
             {
@@ -2460,7 +2552,7 @@ public static class KernelMemoryCompatExports
                 Console.Error.WriteLine(
                     $"[LOADER][TRACE] map_direct reserve: requested=0x{requestedAddress:X16} desired=0x{desiredAddress:X16} reserved={reserved} mapped=0x{mappedAddress:X16}");
             }
-            if (!reserved)
+            if (!reserved && !fixedMapping)
             {
                 if (mappedAddress == 0)
                 {
@@ -2518,8 +2610,11 @@ public static class KernelMemoryCompatExports
         var length = ctx[CpuRegister.Rsi];
         var protection = unchecked((int)ctx[CpuRegister.Rdx]);
         var flags = ctx[CpuRegister.Rcx];
+        if (ShouldTraceDirectMemory())
+        {
             Console.Error.WriteLine(
                 $"[LOADER][TRACE] map_flexible: inout=0x{inOutAddressPointer:X16} len=0x{length:X16} prot=0x{protection:X8} flags=0x{flags:X16}");
+        }
         if (inOutAddressPointer == 0 || length == 0)
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
@@ -2541,16 +2636,25 @@ public static class KernelMemoryCompatExports
             if (fixedMapping && requestedAddress != 0)
             {
                 mappedAddress = requestedAddress;
+                if (!IsGuestRangeBacked(ctx, requestedAddress, length))
+                {
+                    TryReserveExactGuestVirtualRange(ctx, requestedAddress, length, protection);
+                    if (!IsGuestRangeBacked(ctx, requestedAddress, length))
+                    {
+                        mappedAddress = 0;
+                    }
+                }
             }
             else if (!TryReserveGuestVirtualRange(ctx, desiredAddress, length, protection, OrbisPageSize, out mappedAddress))
             {
-                mappedAddress = requestedAddress != 0 && fixedMapping
+                mappedAddress = AllocateMappedGuestAddress(ctx, length, 0x1000UL);
-                    ? requestedAddress
-                    : AllocateMappedGuestAddress(ctx, length, 0x1000UL);
             }
 
+            if (ShouldTraceDirectMemory())
+            {
                 Console.Error.WriteLine(
                     $"[LOADER][TRACE] map_flexible reserve: requested=0x{requestedAddress:X16} desired=0x{desiredAddress:X16} mapped=0x{mappedAddress:X16}");
+            }
 
             if (mappedAddress == 0)
             {
@@ -2586,6 +2690,16 @@ public static class KernelMemoryCompatExports
         return KernelMapNamedFlexibleMemory(ctx);
     }
 
+    [SysAbiExport(
+        Nid = "4h6F1LLbTiw",
+        ExportName = "sceKernelMapFlexibleMemoryInternal",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelMapFlexibleMemoryInternal(CpuContext ctx)
+    {
+        return KernelMapNamedFlexibleMemory(ctx);
+    }
+
     [SysAbiExport(
         Nid = "2SKEx6bSq-4",
         ExportName = "sceKernelBatchMap",
@@ -2639,6 +2753,44 @@ public static class KernelMemoryCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "DGMG3JshrZU",
+        ExportName = "sceKernelSetVirtualRangeName",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelSetVirtualRangeName(CpuContext ctx)
+    {
+        var address = ctx[CpuRegister.Rdi];
+        var length = ctx[CpuRegister.Rsi];
+        var nameAddress = ctx[CpuRegister.Rdx];
+        if (nameAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (!TryReadCString(ctx, nameAddress, OrbisKernelMaximumNameLength, out var nameBytes))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var name = Encoding.UTF8.GetString(nameBytes);
+        lock (_memoryGate)
+        {
+            if (!TryFindVirtualQueryRegionLocked(address, findNext: false, out var region) ||
+                length > region.Length ||
+                address < region.Address ||
+                length > region.Address + region.Length - address)
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            }
+
+            _mappedRegionNames[region.Address] = name;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "rVjRvHJ0X6c",
         ExportName = "sceKernelVirtualQuery",
@@ -2696,11 +2848,16 @@ public static class KernelMemoryCompatExports
         BinaryPrimitives.WriteInt32LittleEndian(payload[28..32], memoryType);
         payload[32] = unchecked((byte)stateFlags);
 
-        var name = region.IsDirect
+        string name;
+        lock (_memoryGate)
+        {
+            name = _mappedRegionNames.GetValueOrDefault(region.Address)
+                ?? (region.IsDirect
                     ? "direct"
                     : region.IsFlexible
                         ? "flexible"
-                : string.Empty;
+                        : string.Empty);
+        }
         if (!string.IsNullOrEmpty(name))
         {
             var nameBytes = Encoding.ASCII.GetBytes(name);
@@ -3842,118 +3999,48 @@ public static class KernelMemoryCompatExports
         ulong alignment,
         out ulong mappedAddress)
     {
-        mappedAddress = 0;
-        if (length == 0)
-        {
-            return false;
-        }
-
-        try
-        {
-            object memoryObject = ctx.Memory;
-            MethodInfo? allocateAt = null;
-            MethodInfo? allocateAtOrAbove = null;
-            var allocateAtHasAllowAlternativeArg = false;
-            for (var depth = 0; depth < 4; depth++)
-            {
-                foreach (var candidate in memoryObject.GetType().GetMethods(BindingFlags.Public | BindingFlags.Instance))
-                {
-                    var parameters = candidate.GetParameters();
-                    if (string.Equals(candidate.Name, "TryAllocateAtOrAbove", StringComparison.Ordinal) &&
-                        parameters.Length == 5 &&
-                        parameters[0].ParameterType == typeof(ulong) &&
-                        parameters[1].ParameterType == typeof(ulong) &&
-                        parameters[2].ParameterType == typeof(bool) &&
-                        parameters[3].ParameterType == typeof(ulong) &&
-                        parameters[4].ParameterType == typeof(ulong).MakeByRefType())
-                    {
-                        allocateAtOrAbove = candidate;
-                    }
-                    else if (string.Equals(candidate.Name, "AllocateAt", StringComparison.Ordinal))
-                    {
-                        if (parameters.Length == 3 &&
-                            parameters[0].ParameterType == typeof(ulong) &&
-                            parameters[1].ParameterType == typeof(ulong) &&
-                            parameters[2].ParameterType == typeof(bool))
-                        {
-                            allocateAt = candidate;
-                            allocateAtHasAllowAlternativeArg = false;
-                        }
-                        else if (parameters.Length == 4 &&
-                            parameters[0].ParameterType == typeof(ulong) &&
-                            parameters[1].ParameterType == typeof(ulong) &&
-                            parameters[2].ParameterType == typeof(bool) &&
-                            parameters[3].ParameterType == typeof(bool))
-                        {
-                            allocateAt = candidate;
-                            allocateAtHasAllowAlternativeArg = true;
-                        }
-                    }
-
-                    if (allocateAtOrAbove is not null && allocateAt is not null)
-                    {
-                        break;
-                    }
-                }
-
-                if (allocateAtOrAbove is not null || allocateAt is not null)
-                {
-                    break;
-                }
-
-                var innerProperty = memoryObject.GetType().GetProperty("Inner", BindingFlags.Public | BindingFlags.Instance);
-                if (innerProperty is null)
-                {
-                    break;
-                }
-
-                var innerValue = innerProperty.GetValue(memoryObject);
-                if (innerValue is null || ReferenceEquals(innerValue, memoryObject))
-                {
-                    break;
-                }
-
-                memoryObject = innerValue;
-            }
-
         var executable = (protection & OrbisProtCpuExec) != 0;
-            if (allocateAtOrAbove is not null)
+        return KernelVirtualRangeAllocator.TryReserve(
-            {
+            ctx,
-                var searchArgs = new object[] { desiredAddress, length, executable, alignment, 0UL };
+            desiredAddress,
-                var searchResult = allocateAtOrAbove.Invoke(memoryObject, searchArgs);
+            length,
-                if (searchResult is bool trueValue && trueValue &&
+            executable,
-                    searchArgs[4] is ulong searchedAddress && searchedAddress != 0)
+            alignment,
-                {
+            allowSearch: true,
-                    mappedAddress = searchedAddress;
+            allowAllocateAtAlternative: false,
-                    return true;
+            "reserve range",
-                }
+            out mappedAddress);
     }
 
-            if (allocateAt is null)
+    private static bool TryReserveExactGuestVirtualRange(
+        CpuContext ctx,
+        ulong desiredAddress,
+        ulong length,
+        int protection)
+    {
+        var executable = (protection & OrbisProtCpuExec) != 0;
+        return KernelVirtualRangeAllocator.TryReserve(
+            ctx,
+            desiredAddress,
+            length,
+            executable,
+            alignment: 0,
+            allowSearch: false,
+            allowAllocateAtAlternative: false,
+            "reserve fixed range",
+            out _);
+    }
+
+    private static bool IsGuestRangeBacked(CpuContext ctx, ulong address, ulong length)
+    {
+        if (address == 0 || length == 0 || ulong.MaxValue - address < length - 1)
         {
-                Console.Error.WriteLine($"[LOADER][TRACE] reserve range: AllocateAt missing on {ctx.Memory.GetType().FullName}");
             return false;
         }
 
-            var invokeArgs = allocateAtHasAllowAlternativeArg
+        Span<byte> probe = stackalloc byte[1];
-                ? new object[] { desiredAddress, length, executable, false }
+        return ctx.Memory.TryRead(address, probe) &&
-                : new object[] { desiredAddress, length, executable };
+               ctx.Memory.TryRead(address + length - 1, probe);
-            var result = allocateAt.Invoke(memoryObject, invokeArgs);
-            if (result is not ulong allocated || allocated == 0)
-            {
-                var resultType = result?.GetType().FullName ?? "null";
-                Console.Error.WriteLine($"[LOADER][TRACE] reserve range: AllocateAt returned {resultType} value={result ?? "null"}");
-                return false;
-            }
-
-            mappedAddress = allocated;
-            return true;
-        }
-        catch
-        {
-            Console.Error.WriteLine("[LOADER][TRACE] reserve range threw while invoking AllocateAt");
-            return false;
-        }
     }
 
     private static bool IsMappedGuestRangeAvailable(
@@ -4033,6 +4120,11 @@ public static class KernelMemoryCompatExports
             return guestPath;
         }
 
+        if (TryResolveRegisteredGuestMount(guestPath, out var mountedPath))
+        {
+            return mountedPath;
+        }
+
         if (guestPath.StartsWith("/devlog/app/", StringComparison.OrdinalIgnoreCase))
         {
             var relative = NormalizeMountRelativePath(guestPath["/devlog/app/".Length..]);
@@ -4101,6 +4193,20 @@ public static class KernelMemoryCompatExports
         var app0Root = ResolveApp0Root();
         if (!string.IsNullOrWhiteSpace(app0Root))
         {
+            if (string.Equals(guestPath, "$", StringComparison.Ordinal) ||
+                string.Equals(guestPath, "$/", StringComparison.Ordinal) ||
+                string.Equals(guestPath, "$\\", StringComparison.Ordinal))
+            {
+                return app0Root;
+            }
+
+            if (guestPath.StartsWith("$/", StringComparison.Ordinal) ||
+                guestPath.StartsWith("$\\", StringComparison.Ordinal))
+            {
+                var relative = NormalizeMountRelativePath(guestPath[2..]);
+                return Path.Combine(app0Root, relative);
+            }
+
             if (string.Equals(guestPath, "/app0", StringComparison.OrdinalIgnoreCase) ||
                 string.Equals(guestPath, "app0", StringComparison.OrdinalIgnoreCase))
             {
@@ -4131,6 +4237,51 @@ public static class KernelMemoryCompatExports
         return guestPath;
     }
 
+    private static bool TryResolveRegisteredGuestMount(string guestPath, out string hostPath)
+    {
+        hostPath = string.Empty;
+        var normalizedGuestPath = NormalizeGuestStatCachePath(guestPath);
+        if (normalizedGuestPath is null)
+        {
+            return false;
+        }
+
+        string? matchedMountPoint = null;
+        string? matchedHostRoot = null;
+        lock (_guestMountGate)
+        {
+            foreach (var (mountPoint, hostRoot) in _guestMounts)
+            {
+                if ((string.Equals(normalizedGuestPath, mountPoint, StringComparison.OrdinalIgnoreCase) ||
+                     normalizedGuestPath.StartsWith(mountPoint + "/", StringComparison.OrdinalIgnoreCase)) &&
+                    (matchedMountPoint is null || mountPoint.Length > matchedMountPoint.Length))
+                {
+                    matchedMountPoint = mountPoint;
+                    matchedHostRoot = hostRoot;
+                }
+            }
+        }
+
+        if (matchedMountPoint is null || matchedHostRoot is null)
+        {
+            return false;
+        }
+
+        var relativePath = normalizedGuestPath[matchedMountPoint.Length..].TrimStart('/');
+        var candidate = Path.GetFullPath(Path.Combine(
+            matchedHostRoot,
+            NormalizeMountRelativePath(relativePath)));
+        var rootWithSeparator = Path.TrimEndingDirectorySeparator(matchedHostRoot) + Path.DirectorySeparatorChar;
+        if (!string.Equals(candidate, matchedHostRoot, StringComparison.OrdinalIgnoreCase) &&
+            !candidate.StartsWith(rootWithSeparator, StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        hostPath = candidate;
+        return true;
+    }
+
     private static string? ResolveApp0Root()
     {
         var cached = Volatile.Read(ref _cachedApp0Root);
@@ -5718,22 +5869,40 @@ public static class KernelMemoryCompatExports
     private static bool TryGetAprFileSize(string hostPath, out ulong size)
     {
         size = 0;
+
+        string cachePath;
         try
         {
-            var fileInfo = new FileInfo(hostPath);
+            cachePath = Path.GetFullPath(hostPath);
+        }
+        catch
+        {
+            cachePath = hostPath;
+        }
+
+        if (_aprFileSizeCache.TryGetValue(cachePath, out size))
+        {
+            return true;
+        }
+
+        try
+        {
+            var fileInfo = new FileInfo(cachePath);
             if (fileInfo.Exists)
             {
                 var length = fileInfo.Length;
                 size = length < 0 ? 0UL : unchecked((ulong)length);
+                _aprFileSizeCache.TryAdd(cachePath, size);
                 return true;
             }
 
-            if (!new DirectoryInfo(hostPath).Exists)
+            if (!new DirectoryInfo(cachePath).Exists)
             {
                 return false;
             }
 
             size = 65536;
+            _aprFileSizeCache.TryAdd(cachePath, size);
             return true;
         }
         catch
@@ -6032,6 +6201,20 @@ public static class KernelMemoryCompatExports
         }
     }
 
+    private static void InvalidateAprFileSizeCache(string hostPath)
+    {
+        try
+        {
+            hostPath = Path.GetFullPath(hostPath);
+        }
+        catch
+        {
+            // The cache key remains the original path when normalization fails.
+        }
+
+        _aprFileSizeCache.TryRemove(hostPath, out _);
+    }
+
     private static string PreviewIoBytes(byte[] buffer, int count, int maxBytes)
     {
         if (count <= 0)

src/SharpEmu.Libs/Kernel/KernelPthreadCompatExports.cs

@@ -95,6 +95,13 @@ public static class KernelPthreadCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "7Xl257M4VNI",
+        ExportName = "pthread_equal",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libc")]
+    public static int PosixPthreadEqual(CpuContext ctx) => PthreadEqual(ctx);
+
     [SysAbiExport(
         Nid = "T72hz6ffq08",
         ExportName = "scePthreadYield",

src/SharpEmu.Libs/Kernel/KernelPthreadExtendedCompatExports.cs

@@ -22,6 +22,7 @@ public static class KernelPthreadExtendedCompatExports
     private const int DefaultSchedPriority = DefaultThreadPriority;
     private const ulong SyntheticRwlockHandleBase = 0x00006003_0000_0000;
     private const ulong SyntheticPthreadAttrHandleBase = 0x00006004_0000_0000;
+    private const ulong SyntheticRwlockAttrHandleBase = 0x00006005_0000_0000;
 
     private static readonly object _stateGate = new();
     private static readonly Dictionary<ulong, ThreadState> _threadStates = new();
@@ -31,6 +32,7 @@ public static class KernelPthreadExtendedCompatExports
     private static int _nextTlsKey = 1;
     private static long _nextSyntheticRwlockHandleId = 1;
     private static long _nextSyntheticPthreadAttrHandleId = 1;
+    private static long _nextSyntheticRwlockAttrHandleId = 1;
 
     private static readonly ConcurrentDictionary<ulong, ConcurrentDictionary<int, ulong>> _threadLocalSpecific = new();
 
@@ -717,6 +719,35 @@ public static class KernelPthreadExtendedCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "FXPWHNk8Of0",
+        ExportName = "scePthreadAttrGetschedparam",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadAttrGetschedparam(CpuContext ctx)
+    {
+        var attrAddress = ctx[CpuRegister.Rdi];
+        var schedParamAddress = ctx[CpuRegister.Rsi];
+        if (attrAddress == 0 || schedParamAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        PthreadAttrState state;
+        lock (_stateGate)
+        {
+            state = GetOrCreateAttrStateLocked(attrAddress);
+        }
+
+        if (!TryWriteInt32(ctx, schedParamAddress, state.SchedPriority))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "DzES9hQF4f4",
         ExportName = "scePthreadAttrSetschedparam",
@@ -810,6 +841,37 @@ public static class KernelPthreadExtendedCompatExports
         return PthreadAttrSetstacksize(ctx);
     }
 
+    [SysAbiExport(
+        Nid = "Bvn74vj6oLo",
+        ExportName = "scePthreadAttrSetstack",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadAttrSetstack(CpuContext ctx)
+    {
+        var attrAddress = ctx[CpuRegister.Rdi];
+        var stackAddress = ctx[CpuRegister.Rsi];
+        var stackSize = ctx[CpuRegister.Rdx];
+        if (attrAddress == 0 || stackAddress == 0 || stackSize == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var resolvedAddress = ResolvePthreadAttrHandle(ctx, attrAddress);
+        lock (_stateGate)
+        {
+            var state = GetOrCreateAttrStateLocked(resolvedAddress);
+            var updated = state with { StackAddress = stackAddress, StackSize = stackSize };
+            _attrStates[resolvedAddress] = updated;
+            if (resolvedAddress != attrAddress)
+            {
+                _attrStates[attrAddress] = updated;
+            }
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "6ULAa0fq4jA",
         ExportName = "scePthreadRwlockInit",
@@ -987,6 +1049,47 @@ public static class KernelPthreadExtendedCompatExports
         LibraryName = "libKernel")]
     public static int PosixPthreadRwlockUnlock(CpuContext ctx) => PthreadRwlockUnlock(ctx);
 
+    [SysAbiExport(
+        Nid = "yOfGg-I1ZII",
+        ExportName = "scePthreadRwlockattrInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadRwlockattrInit(CpuContext ctx)
+    {
+        var attrAddress = ctx[CpuRegister.Rdi];
+        if (attrAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var syntheticHandle = AllocateSyntheticHandle(SyntheticRwlockAttrHandleBase, ref _nextSyntheticRwlockAttrHandleId);
+        if (!KernelMemoryCompatExports.TryWriteUInt64Compat(ctx, attrAddress, syntheticHandle))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "i2ifZ3fS2fo",
+        ExportName = "scePthreadRwlockattrDestroy",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadRwlockattrDestroy(CpuContext ctx)
+    {
+        var attrAddress = ctx[CpuRegister.Rdi];
+        if (attrAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        _ = KernelMemoryCompatExports.TryWriteUInt64Compat(ctx, attrAddress, 0);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "mqULNdimTn0",
         ExportName = "pthread_key_create",
@@ -1016,7 +1119,7 @@ public static class KernelPthreadExtendedCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        ctx[CpuRegister.Rax] = unchecked((uint)key);
+        ctx[CpuRegister.Rax] = 0;
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 

src/SharpEmu.Libs/Kernel/KernelRuntimeCompatExports.cs

@@ -7,7 +7,6 @@ using System.Buffers.Binary;
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.IO;
-using System.Reflection;
 using System.Runtime.InteropServices;
 using System.Runtime.Intrinsics.X86;
 using System.Security.Cryptography;
@@ -87,11 +86,11 @@ public static class KernelRuntimeCompatExports
 
         if (micros < 1000)
         {
-            // Guest worker pools use usleep(1) as a polling backoff. Periodically
+            // Guest worker pools use usleep(1) as a polling backoff. Do not turn
-            // relinquish a full host time slice so spin workers cannot starve producers.
+            // PS microsecond waits into Windows millisecond sleeps on hot paths.
-            if ((++_shortUsleepCount & 31) == 0)
+            if ((++_shortUsleepCount & 255) == 0)
             {
-                Thread.Sleep(1);
+                Thread.Sleep(0);
             }
             else
             {
@@ -739,8 +738,11 @@ public static class KernelRuntimeCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
         }
 
+        if (ShouldTraceVirtualMemory())
+        {
             Console.Error.WriteLine(
                 $"[LOADER][TRACE] reserve_virtual_range: req=0x{requestedAddress:X16} desired=0x{desiredAddress:X16} mapped=0x{mappedAddress:X16} len=0x{length:X16} flags=0x{flags:X8} align=0x{effectiveAlignment:X16}");
+        }
 
         if (!ctx.TryWriteUInt64(inOutAddressPointer, mappedAddress))
         {
@@ -752,6 +754,7 @@ public static class KernelRuntimeCompatExports
             _nextReservedVirtualBase = Math.Max(_nextReservedVirtualBase, mappedAddress + length);
         }
 
+        KernelMemoryCompatExports.RegisterReservedVirtualRange(mappedAddress, length);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
@@ -1732,117 +1735,16 @@ public static class KernelRuntimeCompatExports
         bool allowSearch,
         out ulong mappedAddress)
     {
-        mappedAddress = 0;
+        return KernelVirtualRangeAllocator.TryReserve(
-        if (length == 0)
+            ctx,
-        {
+            desiredAddress,
-            return false;
+            length,
-        }
+            executable: false,
-
+            alignment,
-        try
+            allowSearch,
-        {
+            allowAllocateAtAlternative: allowSearch,
-            object memoryObject = ctx.Memory;
+            "reserve_virtual_range",
-            MethodInfo? allocateAt = null;
+            out mappedAddress);
-            MethodInfo? allocateAtOrAbove = null;
-            var allocateAtHasAllowAlternativeArg = false;
-            for (var depth = 0; depth < 4; depth++)
-            {
-                foreach (var candidate in memoryObject.GetType().GetMethods(BindingFlags.Public | BindingFlags.Instance))
-                {
-                    var parameters = candidate.GetParameters();
-                    if (string.Equals(candidate.Name, "TryAllocateAtOrAbove", StringComparison.Ordinal) &&
-                        parameters.Length == 5 &&
-                        parameters[0].ParameterType == typeof(ulong) &&
-                        parameters[1].ParameterType == typeof(ulong) &&
-                        parameters[2].ParameterType == typeof(bool) &&
-                        parameters[3].ParameterType == typeof(ulong) &&
-                        parameters[4].ParameterType == typeof(ulong).MakeByRefType())
-                    {
-                        allocateAtOrAbove = candidate;
-                    }
-                    else if (string.Equals(candidate.Name, "AllocateAt", StringComparison.Ordinal))
-                    {
-                        if (parameters.Length == 3 &&
-                            parameters[0].ParameterType == typeof(ulong) &&
-                            parameters[1].ParameterType == typeof(ulong) &&
-                            parameters[2].ParameterType == typeof(bool))
-                        {
-                            allocateAt = candidate;
-                            allocateAtHasAllowAlternativeArg = false;
-                        }
-                        else if (parameters.Length == 4 &&
-                            parameters[0].ParameterType == typeof(ulong) &&
-                            parameters[1].ParameterType == typeof(ulong) &&
-                            parameters[2].ParameterType == typeof(bool) &&
-                            parameters[3].ParameterType == typeof(bool))
-                        {
-                            allocateAt = candidate;
-                            allocateAtHasAllowAlternativeArg = true;
-                        }
-                    }
-
-                    if (allocateAtOrAbove is not null && allocateAt is not null)
-                    {
-                        break;
-                    }
-                }
-
-                if (allocateAtOrAbove is not null || allocateAt is not null)
-                {
-                    break;
-                }
-
-                var innerProperty = memoryObject.GetType().GetProperty("Inner", BindingFlags.Public | BindingFlags.Instance);
-                if (innerProperty is null)
-                {
-                    break;
-                }
-
-                var innerValue = innerProperty.GetValue(memoryObject);
-                if (innerValue is null || ReferenceEquals(innerValue, memoryObject))
-                {
-                    break;
-                }
-
-                memoryObject = innerValue;
-            }
-
-            if (allowSearch && allocateAtOrAbove is not null)
-            {
-                var searchArgs = new object[] { desiredAddress, length, false, alignment, 0UL };
-                var searchResult = allocateAtOrAbove.Invoke(memoryObject, searchArgs);
-                if (searchResult is bool trueValue && trueValue &&
-                    searchArgs[4] is ulong searchedAddress && searchedAddress != 0)
-                {
-                    mappedAddress = searchedAddress;
-                    return true;
-                }
-            }
-
-            if (allocateAt is null)
-            {
-                Console.Error.WriteLine($"[LOADER][TRACE] reserve_virtual_range: AllocateAt missing on {ctx.Memory.GetType().FullName}");
-                return false;
-            }
-
-            var invokeArgs = allocateAtHasAllowAlternativeArg
-                ? new object[] { desiredAddress, length, false, allowSearch }
-                : new object[] { desiredAddress, length, false };
-            var result = allocateAt.Invoke(memoryObject, invokeArgs);
-            if (result is not ulong allocated || allocated == 0)
-            {
-                var resultType = result?.GetType().FullName ?? "null";
-                Console.Error.WriteLine($"[LOADER][TRACE] reserve_virtual_range: AllocateAt returned {resultType} value={result ?? "null"}");
-                return false;
-            }
-
-            mappedAddress = allocated;
-            return true;
-        }
-        catch
-        {
-            Console.Error.WriteLine("[LOADER][TRACE] reserve_virtual_range: AllocateAt invocation threw");
-            return false;
-        }
     }
 
     private static ulong AlignUp(ulong value, ulong alignment)
@@ -1855,4 +1757,9 @@ public static class KernelRuntimeCompatExports
         var mask = alignment - 1;
         return (value + mask) & ~mask;
     }
+
+    private static bool ShouldTraceVirtualMemory()
+    {
+        return string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_VIRTUAL_MEMORY"), "1", StringComparison.Ordinal);
+    }
 }

src/SharpEmu.Libs/Kernel/KernelVirtualRangeAllocator.cs

@@ -0,0 +1,159 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System;
+using System.Collections.Concurrent;
+using System.Reflection;
+
+namespace SharpEmu.Libs.Kernel;
+
+internal static class KernelVirtualRangeAllocator
+{
+    private static readonly ConcurrentDictionary<Type, Accessor> _accessors = new();
+
+    public static bool TryReserve(
+        CpuContext ctx,
+        ulong desiredAddress,
+        ulong length,
+        bool executable,
+        ulong alignment,
+        bool allowSearch,
+        bool allowAllocateAtAlternative,
+        string traceName,
+        out ulong mappedAddress)
+    {
+        mappedAddress = 0;
+        if (length == 0)
+        {
+            return false;
+        }
+
+        try
+        {
+            if (!TryResolveAccessor(ctx.Memory, out var target, out var accessor))
+            {
+                Console.Error.WriteLine($"[LOADER][TRACE] {traceName}: AllocateAt missing on {ctx.Memory.GetType().FullName}");
+                return false;
+            }
+
+            if (allowSearch && accessor.AllocateAtOrAbove is not null)
+            {
+                var searchArgs = new object[] { desiredAddress, length, executable, alignment, 0UL };
+                var searchResult = accessor.AllocateAtOrAbove.Invoke(target, searchArgs);
+                if (searchResult is bool trueValue && trueValue &&
+                    searchArgs[4] is ulong searchedAddress && searchedAddress != 0)
+                {
+                    mappedAddress = searchedAddress;
+                    return true;
+                }
+            }
+
+            if (accessor.AllocateAt is null)
+            {
+                Console.Error.WriteLine($"[LOADER][TRACE] {traceName}: AllocateAt missing on {target.GetType().FullName}");
+                return false;
+            }
+
+            var invokeArgs = accessor.AllocateAtHasAllowAlternativeArg
+                ? new object[] { desiredAddress, length, executable, allowAllocateAtAlternative }
+                : new object[] { desiredAddress, length, executable };
+            var result = accessor.AllocateAt.Invoke(target, invokeArgs);
+            if (result is not ulong allocated || allocated == 0)
+            {
+                var resultType = result?.GetType().FullName ?? "null";
+                Console.Error.WriteLine($"[LOADER][TRACE] {traceName}: AllocateAt returned {resultType} value={result ?? "null"}");
+                return false;
+            }
+
+            mappedAddress = allocated;
+            return true;
+        }
+        catch
+        {
+            Console.Error.WriteLine($"[LOADER][TRACE] {traceName}: AllocateAt invocation threw");
+            return false;
+        }
+    }
+
+    private static bool TryResolveAccessor(object rootMemory, out object target, out Accessor accessor)
+    {
+        target = rootMemory;
+        accessor = default;
+
+        for (var depth = 0; depth < 4; depth++)
+        {
+            accessor = _accessors.GetOrAdd(target.GetType(), DiscoverAccessor);
+            if (accessor.AllocateAt is not null || accessor.AllocateAtOrAbove is not null)
+            {
+                return true;
+            }
+
+            if (accessor.InnerProperty is null)
+            {
+                break;
+            }
+
+            var innerValue = accessor.InnerProperty.GetValue(target);
+            if (innerValue is null || ReferenceEquals(innerValue, target))
+            {
+                break;
+            }
+
+            target = innerValue;
+        }
+
+        return false;
+    }
+
+    private static Accessor DiscoverAccessor(Type type)
+    {
+        MethodInfo? allocateAt = null;
+        MethodInfo? allocateAtOrAbove = null;
+        var allocateAtHasAllowAlternativeArg = false;
+
+        foreach (var candidate in type.GetMethods(BindingFlags.Public | BindingFlags.Instance))
+        {
+            var parameters = candidate.GetParameters();
+            if (string.Equals(candidate.Name, "TryAllocateAtOrAbove", StringComparison.Ordinal) &&
+                parameters.Length == 5 &&
+                parameters[0].ParameterType == typeof(ulong) &&
+                parameters[1].ParameterType == typeof(ulong) &&
+                parameters[2].ParameterType == typeof(bool) &&
+                parameters[3].ParameterType == typeof(ulong) &&
+                parameters[4].ParameterType == typeof(ulong).MakeByRefType())
+            {
+                allocateAtOrAbove = candidate;
+            }
+            else if (string.Equals(candidate.Name, "AllocateAt", StringComparison.Ordinal))
+            {
+                if (parameters.Length == 3 &&
+                    parameters[0].ParameterType == typeof(ulong) &&
+                    parameters[1].ParameterType == typeof(ulong) &&
+                    parameters[2].ParameterType == typeof(bool))
+                {
+                    allocateAt = candidate;
+                    allocateAtHasAllowAlternativeArg = false;
+                }
+                else if (parameters.Length == 4 &&
+                    parameters[0].ParameterType == typeof(ulong) &&
+                    parameters[1].ParameterType == typeof(ulong) &&
+                    parameters[2].ParameterType == typeof(bool) &&
+                    parameters[3].ParameterType == typeof(bool))
+                {
+                    allocateAt = candidate;
+                    allocateAtHasAllowAlternativeArg = true;
+                }
+            }
+        }
+
+        var innerProperty = type.GetProperty("Inner", BindingFlags.Public | BindingFlags.Instance);
+        return new Accessor(allocateAt, allocateAtOrAbove, allocateAtHasAllowAlternativeArg, innerProperty);
+    }
+
+    private readonly record struct Accessor(
+        MethodInfo? AllocateAt,
+        MethodInfo? AllocateAtOrAbove,
+        bool AllocateAtHasAllowAlternativeArg,
+        PropertyInfo? InnerProperty);
+}

src/SharpEmu.Libs/Ngs2/Ngs2Exports.cs

@@ -0,0 +1,322 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using SharpEmu.Libs.Kernel;
+using System.Buffers.Binary;
+using System.Threading;
+
+namespace SharpEmu.Libs.Ngs2;
+
+public static class Ngs2Exports
+{
+    private const int OrbisNgs2ErrorInvalidOutAddress = unchecked((int)0x804A0053);
+    private const int OrbisNgs2ErrorInvalidSystemHandle = unchecked((int)0x804A0230);
+    private const int OrbisNgs2ErrorInvalidRackHandle = unchecked((int)0x804A0261);
+    private const int OrbisNgs2ErrorInvalidVoiceHandle = unchecked((int)0x804A0300);
+    private const ulong HandleStorageSize = 0x20;
+    private const int RenderBufferInfoSize = 0x18;
+    private const ulong MaximumRenderBufferSize = 16 * 1024 * 1024;
+
+    private static readonly object StateGate = new();
+    private static readonly Dictionary<ulong, SystemState> Systems = new();
+    private static readonly Dictionary<ulong, RackState> Racks = new();
+    private static readonly Dictionary<ulong, VoiceState> Voices = new();
+    private static long _nextUid;
+    private static long _renderCount;
+
+    private sealed record SystemState(uint Uid);
+    private sealed record RackState(ulong SystemHandle, uint RackId);
+    private sealed record VoiceState(ulong RackHandle, uint VoiceIndex);
+
+    [SysAbiExport(
+        Nid = "mPYgU4oYpuY",
+        ExportName = "sceNgs2SystemCreateWithAllocator",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2SystemCreateWithAllocator(CpuContext ctx)
+    {
+        var outHandleAddress = ctx[CpuRegister.Rdx];
+        if (outHandleAddress == 0)
+        {
+            return SetReturn(ctx, OrbisNgs2ErrorInvalidOutAddress);
+        }
+
+        if (!TryCreateHandle(ctx, type: 1, ownerHandle: 0, out var handle) ||
+            !ctx.TryWriteUInt64(outHandleAddress, handle))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        lock (StateGate)
+        {
+            Systems[handle] = new SystemState(unchecked((uint)Interlocked.Increment(ref _nextUid)));
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "u-WrYDaJA3k",
+        ExportName = "sceNgs2SystemDestroy",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2SystemDestroy(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        lock (StateGate)
+        {
+            if (!Systems.Remove(handle))
+            {
+                return SetReturn(ctx, OrbisNgs2ErrorInvalidSystemHandle);
+            }
+
+            var rackHandles = Racks
+                .Where(pair => pair.Value.SystemHandle == handle)
+                .Select(pair => pair.Key)
+                .ToArray();
+            foreach (var rackHandle in rackHandles)
+            {
+                RemoveRackLocked(rackHandle);
+            }
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "U546k6orxQo",
+        ExportName = "sceNgs2RackCreateWithAllocator",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2RackCreateWithAllocator(CpuContext ctx)
+    {
+        var systemHandle = ctx[CpuRegister.Rdi];
+        var rackId = unchecked((uint)ctx[CpuRegister.Rsi]);
+        var outHandleAddress = ctx[CpuRegister.R8];
+        lock (StateGate)
+        {
+            if (!Systems.ContainsKey(systemHandle))
+            {
+                return SetReturn(ctx, OrbisNgs2ErrorInvalidSystemHandle);
+            }
+        }
+
+        if (outHandleAddress == 0)
+        {
+            return SetReturn(ctx, OrbisNgs2ErrorInvalidOutAddress);
+        }
+
+        if (!TryCreateHandle(ctx, type: 2, systemHandle, out var handle) ||
+            !ctx.TryWriteUInt64(outHandleAddress, handle))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        lock (StateGate)
+        {
+            Racks[handle] = new RackState(systemHandle, rackId);
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "lCqD7oycmIM",
+        ExportName = "sceNgs2RackDestroy",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2RackDestroy(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        lock (StateGate)
+        {
+            if (!Racks.ContainsKey(handle))
+            {
+                return SetReturn(ctx, OrbisNgs2ErrorInvalidRackHandle);
+            }
+
+            RemoveRackLocked(handle);
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "MwmHz8pAdAo",
+        ExportName = "sceNgs2RackGetVoiceHandle",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2RackGetVoiceHandle(CpuContext ctx)
+    {
+        var rackHandle = ctx[CpuRegister.Rdi];
+        var voiceIndex = unchecked((uint)ctx[CpuRegister.Rsi]);
+        var outHandleAddress = ctx[CpuRegister.Rdx];
+        lock (StateGate)
+        {
+            if (!Racks.ContainsKey(rackHandle))
+            {
+                return SetReturn(ctx, OrbisNgs2ErrorInvalidRackHandle);
+            }
+
+            var existing = Voices.FirstOrDefault(
+                pair => pair.Value.RackHandle == rackHandle && pair.Value.VoiceIndex == voiceIndex);
+            if (existing.Key != 0)
+            {
+                return ctx.TryWriteUInt64(outHandleAddress, existing.Key)
+                    ? SetReturn(ctx, 0)
+                    : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+        }
+
+        if (outHandleAddress == 0)
+        {
+            return SetReturn(ctx, OrbisNgs2ErrorInvalidOutAddress);
+        }
+
+        if (!TryCreateHandle(ctx, type: 4, rackHandle, out var handle) ||
+            !ctx.TryWriteUInt64(outHandleAddress, handle))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        lock (StateGate)
+        {
+            Voices[handle] = new VoiceState(rackHandle, voiceIndex);
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "uu94irFOGpA",
+        ExportName = "sceNgs2VoiceControl",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2VoiceControl(CpuContext ctx)
+    {
+        lock (StateGate)
+        {
+            return SetReturn(
+                ctx,
+                Voices.ContainsKey(ctx[CpuRegister.Rdi]) ? 0 : OrbisNgs2ErrorInvalidVoiceHandle);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "AbYvTOZ8Pts",
+        ExportName = "sceNgs2VoiceRunCommands",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2VoiceRunCommands(CpuContext ctx) => Ngs2VoiceControl(ctx);
+
+    [SysAbiExport(
+        Nid = "i0VnXM-C9fc",
+        ExportName = "sceNgs2SystemRender",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2SystemRender(CpuContext ctx)
+    {
+        var systemHandle = ctx[CpuRegister.Rdi];
+        var bufferInfoAddress = ctx[CpuRegister.Rsi];
+        var bufferInfoCount = unchecked((uint)ctx[CpuRegister.Rdx]);
+        lock (StateGate)
+        {
+            if (!Systems.ContainsKey(systemHandle))
+            {
+                return SetReturn(ctx, OrbisNgs2ErrorInvalidSystemHandle);
+            }
+        }
+
+        if (bufferInfoCount != 0 && bufferInfoAddress == 0)
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        for (uint i = 0; i < bufferInfoCount; i++)
+        {
+            var entryAddress = bufferInfoAddress + (i * RenderBufferInfoSize);
+            if (!ctx.TryReadUInt64(entryAddress, out var bufferAddress) ||
+                !ctx.TryReadUInt64(entryAddress + 8, out var bufferSize))
+            {
+                return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            if (bufferAddress != 0 && bufferSize != 0)
+            {
+                if (bufferSize > MaximumRenderBufferSize || !TryClearGuestBuffer(ctx, bufferAddress, bufferSize))
+                {
+                    return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                }
+            }
+        }
+
+        var count = Interlocked.Increment(ref _renderCount);
+        if (ShouldTrace() && (count <= 4 || count % 10_000 == 0))
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][TRACE] ngs2.render#{count} system=0x{systemHandle:X16} buffers={bufferInfoCount}");
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    private static bool TryCreateHandle(CpuContext ctx, uint type, ulong ownerHandle, out ulong handle)
+    {
+        handle = 0;
+        if (!KernelMemoryCompatExports.TryAllocateHleData(ctx, HandleStorageSize, 16, out handle))
+        {
+            return false;
+        }
+
+        Span<byte> data = stackalloc byte[(int)HandleStorageSize];
+        data.Clear();
+        BinaryPrimitives.WriteUInt64LittleEndian(data[0..8], handle);
+        BinaryPrimitives.WriteUInt64LittleEndian(data[8..16], ownerHandle);
+        BinaryPrimitives.WriteUInt32LittleEndian(data[16..20], 1);
+        BinaryPrimitives.WriteUInt32LittleEndian(data[24..28], type);
+        return ctx.Memory.TryWrite(handle, data);
+    }
+
+    private static bool TryClearGuestBuffer(CpuContext ctx, ulong address, ulong length)
+    {
+        Span<byte> zeroes = stackalloc byte[4096];
+        zeroes.Clear();
+        for (ulong offset = 0; offset < length;)
+        {
+            var chunkSize = (int)Math.Min((ulong)zeroes.Length, length - offset);
+            if (!ctx.Memory.TryWrite(address + offset, zeroes[..chunkSize]))
+            {
+                return false;
+            }
+
+            offset += unchecked((uint)chunkSize);
+        }
+
+        return true;
+    }
+
+    private static void RemoveRackLocked(ulong rackHandle)
+    {
+        Racks.Remove(rackHandle);
+        foreach (var voiceHandle in Voices
+                     .Where(pair => pair.Value.RackHandle == rackHandle)
+                     .Select(pair => pair.Key)
+                     .ToArray())
+        {
+            Voices.Remove(voiceHandle);
+        }
+    }
+
+    private static bool ShouldTrace() =>
+        string.Equals(
+            Environment.GetEnvironmentVariable("SHARPEMU_LOG_NGS2"),
+            "1",
+            StringComparison.Ordinal);
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}

src/SharpEmu.Libs/Pad/PadExports.cs

@@ -4,6 +4,7 @@
 using SharpEmu.HLE;
 using System.Buffers.Binary;
 using System.Diagnostics;
+using System.Runtime.InteropServices;
 
 namespace SharpEmu.Libs.Pad;
 
@@ -58,6 +59,7 @@ public static class PadExports
             return SetReturn(ctx, OrbisPadErrorDeviceNotConnected);
         }
 
+        Console.Error.WriteLine("[LOADER][INFO] Keyboard controls: Arrow keys = D-pad, WASD = left stick, IJKL = right stick, Z/Enter = Cross, X/Esc = Circle, C = Square, V = Triangle, Q = L1, E = R1, R = L2, F = R2, Tab/Backspace = Options");
         return SetReturn(ctx, PrimaryPadHandle);
     }
 
@@ -158,14 +160,33 @@ public static class PadExports
             : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
     }
 
+    [SysAbiExport(
+    Nid = "W2G-yoyMF5U",
+    ExportName = "scePadSetVibrationMode",
+    Target = Generation.Gen4 | Generation.Gen5,
+    LibraryName = "libScePad")]
+    public static int PadSetVibrationMode(CpuContext ctx)
+    {
+        return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
     private static bool WriteNeutralPadData(CpuContext ctx, ulong dataAddress)
     {
         Span<byte> data = stackalloc byte[PadDataSize];
         data.Clear();
-        data[0x04] = 128;
+        var acceptsKeyboardInput = IsEmulatorWindowFocused();
-        data[0x05] = 128;
+        var buttons = acceptsKeyboardInput ? ReadKeyboardButtons() : 0;
-        data[0x06] = 128;
+        BinaryPrimitives.WriteUInt32LittleEndian(data[0x00..], buttons);
-        data[0x07] = 128;
+        var leftX = acceptsKeyboardInput ? ReadAnalogStick(IsKeyDown(0x41), IsKeyDown(0x44)) : (byte)128;
+        var leftY = acceptsKeyboardInput ? ReadAnalogStick(IsKeyDown(0x57), IsKeyDown(0x53)) : (byte)128;
+        var rightX = acceptsKeyboardInput ? ReadAnalogStick(IsKeyDown(0x4A), IsKeyDown(0x4C)) : (byte)128;
+        var rightY = acceptsKeyboardInput ? ReadAnalogStick(IsKeyDown(0x49), IsKeyDown(0x4B)) : (byte)128;
+        data[0x04] = leftX;
+        data[0x05] = leftY;
+        data[0x06] = rightX;
+        data[0x07] = rightY;
+        data[0x08] = acceptsKeyboardInput && IsKeyDown(0x52) ? (byte)255 : (byte)0;
+        data[0x09] = acceptsKeyboardInput && IsKeyDown(0x46) ? (byte)255 : (byte)0;
         BinaryPrimitives.WriteSingleLittleEndian(data[0x18..], 1.0f);
         data[0x4C] = 1;
         var timestampTicks = Stopwatch.GetTimestamp();
@@ -185,4 +206,58 @@ public static class PadExports
         ctx[CpuRegister.Rax] = unchecked((ulong)result);
         return result;
     }
+
+    [DllImport("user32.dll")]
+    private static extern short GetAsyncKeyState(int vKey);
+
+    [DllImport("user32.dll")]
+    private static extern nint GetForegroundWindow();
+
+    [DllImport("user32.dll")]
+    private static extern uint GetWindowThreadProcessId(nint hWnd, out uint processId);
+
+    private static bool IsKeyDown(int vk) =>
+        (GetAsyncKeyState(vk) & 0x8000) != 0;
+
+    private static bool IsEmulatorWindowFocused()
+    {
+        var foregroundWindow = GetForegroundWindow();
+        if (foregroundWindow == 0)
+        {
+            return false;
+        }
+
+        GetWindowThreadProcessId(foregroundWindow, out var processId);
+        return processId == (uint)Environment.ProcessId;
+    }
+
+    private static uint ReadKeyboardButtons()
+    {
+        uint buttons = 0;
+        // D-pad
+        if (IsKeyDown(0x25)) buttons |= 0x0080; // Left
+        if (IsKeyDown(0x27)) buttons |= 0x0020; // Right
+        if (IsKeyDown(0x26)) buttons |= 0x0010; // Up
+        if (IsKeyDown(0x28)) buttons |= 0x0040; // Down
+        // Face buttons
+        if (IsKeyDown(0x5A) || IsKeyDown(0x0D)) buttons |= 0x4000; // Z / Enter = Cross
+        if (IsKeyDown(0x58) || IsKeyDown(0x1B)) buttons |= 0x2000; // X / Escape = Circle
+        if (IsKeyDown(0x43)) buttons |= 0x8000; // C = Square
+        if (IsKeyDown(0x56)) buttons |= 0x1000; // V = Triangle
+        // Shoulder buttons
+        if (IsKeyDown(0x51)) buttons |= 0x0400; // Q = L1
+        if (IsKeyDown(0x45)) buttons |= 0x0800; // E = R1
+        if (IsKeyDown(0x52)) buttons |= 0x0100; // R = L2 (digital)
+        if (IsKeyDown(0x46)) buttons |= 0x0200; // F = R2 (digital)
+        // Options (Start)
+        if (IsKeyDown(0x09) || IsKeyDown(0x08)) buttons |= 0x0008; // Tab / Backspace = Options
+        return buttons;
+    }
+
+    private static byte ReadAnalogStick(bool negative, bool positive)
+    {
+        if (negative && !positive) return 0;
+        if (positive && !negative) return 255;
+        return 128;
+    }
 }

src/SharpEmu.Libs/SaveData/SaveDataExports.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
+using SharpEmu.Libs.Kernel;
 using System.Buffers.Binary;
 using System.Text;
 
@@ -10,6 +11,8 @@ namespace SharpEmu.Libs.SaveData;
 public static class SaveDataExports
 {
     private const int OrbisSaveDataErrorParameter = unchecked((int)0x809F0000);
+    private const int OrbisSaveDataErrorExists = unchecked((int)0x809F0007);
+    private const int OrbisSaveDataErrorNotFound = unchecked((int)0x809F0008);
     private const int OrbisSaveDataErrorInternal = unchecked((int)0x809F000B);
     private const int SaveDataTitleIdSize = 10;
     private const int SaveDataDirNameSize = 32;
@@ -23,6 +26,9 @@ public static class SaveDataExports
     private const ulong ResultInfosOffset = 0x20;
     private const uint SortKeyFreeBlocks = 5;
     private const uint SortOrderDescent = 1;
+    private const uint MountModeCreate = 1u << 2;
+    private const uint MountModeCreate2 = 1u << 5;
+    private const int MountResultSize = 0x40;
     private static readonly object _stateGate = new();
     private static string? _titleId;
 
@@ -149,6 +155,125 @@ public static class SaveDataExports
         }
     }
 
+    [SysAbiExport(
+        Nid = "ZP4e7rlzOUk",
+        ExportName = "sceSaveDataMount3",
+        Target = Generation.Gen5,
+        LibraryName = "libSceSaveData")]
+    public static int SaveDataMount3(CpuContext ctx)
+    {
+        var mountAddress = ctx[CpuRegister.Rdi];
+        var resultAddress = ctx[CpuRegister.Rsi];
+        if (mountAddress == 0 || resultAddress == 0)
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorParameter);
+        }
+
+        if (!TryReadInt32(ctx, mountAddress, out var userId) ||
+            !ctx.TryReadUInt64(mountAddress + 0x08, out var dirNameAddress) ||
+            !ctx.TryReadUInt64(mountAddress + 0x10, out var blocks) ||
+            !ctx.TryReadUInt64(mountAddress + 0x18, out var systemBlocks) ||
+            !TryReadUInt32(ctx, mountAddress + 0x20, out var mountMode) ||
+            !TryReadUInt32(ctx, mountAddress + 0x24, out var resource) ||
+            !TryReadUInt32(ctx, mountAddress + 0x28, out var mode) ||
+            dirNameAddress == 0 ||
+            !TryReadFixedAscii(ctx, dirNameAddress, SaveDataDirNameSize, out var dirName))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        if (userId < 0 || string.IsNullOrWhiteSpace(dirName))
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorParameter);
+        }
+
+        try
+        {
+            var titleId = ResolveConfiguredTitleId();
+            var savePath = Path.Combine(
+                ResolveTitleSaveRoot(userId, titleId),
+                SanitizePathSegment(dirName));
+            var existed = Directory.Exists(savePath);
+            var create = (mountMode & MountModeCreate) != 0;
+            var createIfMissing = (mountMode & MountModeCreate2) != 0;
+
+            if (!existed && !create && !createIfMissing)
+            {
+                return SetReturn(ctx, OrbisSaveDataErrorNotFound);
+            }
+
+            if (existed && create)
+            {
+                return SetReturn(ctx, OrbisSaveDataErrorExists);
+            }
+
+            if (!existed)
+            {
+                Directory.CreateDirectory(savePath);
+            }
+
+            const string mountPoint = "/savedata0";
+            KernelMemoryCompatExports.RegisterGuestPathMount(mountPoint, savePath);
+
+            Span<byte> result = stackalloc byte[MountResultSize];
+            result.Clear();
+            WriteAscii(result[..16], mountPoint);
+            BinaryPrimitives.WriteUInt32LittleEndian(result[0x1C..], createIfMissing && !existed ? 1u : 0u);
+            if (!ctx.Memory.TryWrite(resultAddress, result))
+            {
+                return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            TraceSaveData(
+                $"mount3 user={userId} title={titleId} dir={dirName} blocks={blocks} " +
+                $"system_blocks={systemBlocks} mount_mode=0x{mountMode:X} resource={resource} mode={mode} " +
+                $"mount_point={mountPoint} created={!existed} root='{savePath}'");
+            return SetReturn(ctx, 0);
+        }
+        catch (IOException)
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorInternal);
+        }
+        catch (UnauthorizedAccessException)
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorInternal);
+        }
+        catch (ArgumentException)
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorParameter);
+        }
+    }
+
+    private static int _nextTransactionResource;
+    [SysAbiExport(
+        Nid = "gjRZNnw0JPE",
+        ExportName = "sceSaveDataCreateTransactionResource",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceSaveData")]
+    public static int SaveDataCreateTransactionResource(CpuContext ctx)
+    {
+        var userId = unchecked((int)ctx[CpuRegister.Rdi]);
+        var reserved = ctx[CpuRegister.Rsi];
+        var resourceAddress = ctx[CpuRegister.Rdx];
+
+        if (resourceAddress == 0)
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorParameter);
+        }
+
+        var id = (uint)Interlocked.Increment(ref _nextTransactionResource);
+
+        if (!TryWriteUInt32(ctx, resourceAddress, id))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceSaveData(
+            $"create_transaction_resource user={userId} reserved=0x{reserved:X} resource_addr=0x{resourceAddress:X} id={id}");
+
+        return SetReturn(ctx, 0);
+    }
+
     private static bool TryReadSearchCond(CpuContext ctx, ulong address, out SearchCond cond)
     {
         cond = default;
@@ -305,7 +430,7 @@ public static class SaveDataExports
     {
         var configured = Environment.GetEnvironmentVariable("SHARPEMU_SAVEDATA_DIR");
         var root = string.IsNullOrWhiteSpace(configured)
-            ? Path.Combine(Environment.CurrentDirectory, "user", "savedata")
+            ? Path.Combine(AppContext.BaseDirectory, "user", "savedata")
             : configured;
         return Path.GetFullPath(root);
     }

src/SharpEmu.Libs/SharpEmu.Libs.csproj

@@ -10,6 +10,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
 
   <ItemGroup>
     <PackageReference Include="Silk.NET.Vulkan" />
+    <PackageReference Include="Silk.NET.Vulkan.Extensions.EXT" />
     <PackageReference Include="Silk.NET.Vulkan.Extensions.KHR" />
     <PackageReference Include="Silk.NET.Windowing" />
   </ItemGroup>

src/SharpEmu.Libs/VideoOut/VideoOutExports.cs

@@ -4,6 +4,7 @@
 using SharpEmu.HLE;
 using SharpEmu.Libs.Kernel;
 using System.Buffers.Binary;
+using System.Diagnostics;
 using System.Diagnostics.CodeAnalysis;
 using System.Threading;
 
@@ -48,6 +49,13 @@ public static class VideoOutExports
     private static int _frameDumpCount;
     private static long _nextFrameDumpIndex;
     private static string _windowTitle = "SharpEmu VideoOut";
+    private static readonly bool _logFrameRate = string.Equals(
+        Environment.GetEnvironmentVariable("SHARPEMU_LOG_VIDEOOUT_FPS"),
+        "1",
+        StringComparison.Ordinal);
+    private static long _frameRateWindowStart = Stopwatch.GetTimestamp();
+    private static long _submittedFrameCount;
+    private static long _presentedFrameCount;
 
     public static void ConfigureApplicationInfo(string? title, string? titleId, string? version)
     {
@@ -812,9 +820,46 @@ public static class VideoOutExports
         }
 
         TraceVideoOut($"videoout.submit_flip handle={handle} index={bufferIndex} mode={flipMode} arg={flipArg} events={flipEvents.Count}");
+        ReportFrameRate(presented: false);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    internal static void ReportPresentedFrame() =>
+        ReportFrameRate(presented: true);
+
+    private static void ReportFrameRate(bool presented)
+    {
+        if (!_logFrameRate)
+        {
+            return;
+        }
+
+        if (presented)
+        {
+            Interlocked.Increment(ref _presentedFrameCount);
+        }
+        else
+        {
+            Interlocked.Increment(ref _submittedFrameCount);
+        }
+
+        var started = Volatile.Read(ref _frameRateWindowStart);
+        var now = Stopwatch.GetTimestamp();
+        var elapsedTicks = now - started;
+        if (elapsedTicks < Stopwatch.Frequency ||
+            Interlocked.CompareExchange(ref _frameRateWindowStart, now, started) != started)
+        {
+            return;
+        }
+
+        var elapsedSeconds = (double)elapsedTicks / Stopwatch.Frequency;
+        var submitted = Interlocked.Exchange(ref _submittedFrameCount, 0);
+        var presentedCount = Interlocked.Exchange(ref _presentedFrameCount, 0);
+        Console.Error.WriteLine(
+            $"[LOADER][PERF] videoout submitted_fps={submitted / elapsedSeconds:F1} " +
+            $"presented_fps={presentedCount / elapsedSeconds:F1}");
+    }
+
     private static int RegisterBufferRange(VideoOutPortState port, int startIndex, ReadOnlySpan<ulong> addresses, BufferAttribute attribute, int requestedGroupIndex = -1)
     {
         lock (_stateGate)

src/SharpEmu.Libs/packages.lock.json

@@ -11,6 +11,16 @@
           "Silk.NET.Core": "2.23.0"
         }
       },
+      "Silk.NET.Vulkan.Extensions.EXT": {
+        "type": "Direct",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "+Oth189ksRiL6HvGCwIdnsYHawqrbO8y49u1H61z3wsfcHhQZeVDYe/wF5LD7fk3NcdgDvwFD3mLm1QWhdZySw==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
       "Silk.NET.Vulkan.Extensions.KHR": {
         "type": "Direct",
         "requested": "[2.23.0, )",