[kernel] Added KernelExceptionCompatExports and fstat, pthread_equal

- Enable VertexPipelineStoresAndAtomics/FragmentStoresAndAtomics:
  fixes vkCreateGraphicsPipelines() rejecting guestBuffers storage
  descriptor as NonWritable in vertex/fragment stages.
- Enable ShaderInt64: fixes vkCreateShaderModule() rejecting SPIR-V
  using 64-bit integer capability.
- Query GetPhysicalDeviceFeatures first and only enable what the GPU
  actually reports as supported, with a warning fallback otherwise.

Also adds optional Vulkan Validation Layers (SHARPEMU_VK_VALIDATION=1)
to surface these VUID errors during development instead of silent
VK_ERROR_DEVICE_LOST.

.editorconfig

@@ -14,7 +14,7 @@ indent_size = 4
 indent_style = space
 tab_width = 4
 
-[*.{md,json,yml,props,csproj}]
+[*.{md,json,yml,xml,props,csproj}]
 
 indent_size = 2
 tab_width = 2

.github/workflows/workflow.yml

@@ -126,7 +126,7 @@ jobs:
     needs:
       - init
       - build
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
     runs-on: ubuntu-latest
     permissions:
       contents: write

.gitignore

@@ -26,6 +26,7 @@ arm64/
 *.userosscache
 *.sln.docstates
 
+.packages
 packages/
 *.nupkg
 .nuget/

Directory.Packages.props

@@ -2,7 +2,6 @@
 Copyright (C) 2026 SharpEmu Emulator Project
 SPDX-License-Identifier: GPL-2.0-or-later
 -->
-
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
@@ -10,7 +9,8 @@ SPDX-License-Identifier: GPL-2.0-or-later
   <ItemGroup>
     <PackageVersion Include="Iced" Version="1.21.0" />
     <PackageVersion Include="Silk.NET.Vulkan" Version="2.23.0" />
+    <PackageVersion Include="Silk.NET.Vulkan.Extensions.EXT" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.KHR" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Windowing" Version="2.23.0" />
   </ItemGroup>
-</Project>
+</Project>

REUSE.toml

@@ -3,12 +3,14 @@ version = 1
 [[annotations]]
 path = [
     "REUSE.toml",
+    "nuget.config",
     "global.json",
     "**/packages.lock.json",
     "scripts/ps5_names.txt",
     "src/SharpEmu.HLE/Aerolib/aerolib.bin",
     "_logs/**",
-    ".github/images/**"
+    ".github/images/**",
+    "assets/images/**"
 ]
 precedence = "aggregate"
 SPDX-FileCopyrightText = "SharpEmu Emulator Project"

nuget.config

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<configuration>
+  <config>
+    <add key="globalPackagesFolder" value=".packages" />
+  </config>
+
+  <packageSources>
+    <clear />
+    <add key="Nuget" value="https://api.nuget.org/v3/index.json" />
+  </packageSources>
+
+  <packageSourceMapping>
+    <packageSource key="Nuget">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>

src/SharpEmu.CLI/SharpEmu.CLI.csproj

@@ -16,7 +16,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <RuntimeIdentifiers>win-x64;linux-x64;osx-arm64</RuntimeIdentifiers>
     <SelfContained>true</SelfContained>
     <PublishSingleFile>true</PublishSingleFile>
-    <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract>
+    <!-- <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract> -->
     <EnableCompressionInSingleFile>true</EnableCompressionInSingleFile>
     <ImplicitUsings>enable</ImplicitUsings>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
@@ -30,6 +30,11 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
   </PropertyGroup>
 
+  <PropertyGroup Condition="'$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == ''">
+    <ApplicationIcon>..\..\assets\images\SharpEmu.ico</ApplicationIcon>
+    <Win32Icon>..\..\assets\images\SharpEmu.ico</Win32Icon>
+  </PropertyGroup>
+
   <ItemGroup>
     <Content Include="..\..\LICENSE.txt">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>

src/SharpEmu.CLI/packages.lock.json

@@ -81,6 +81,7 @@
         "dependencies": {
           "SharpEmu.HLE": "[1.0.0, )",
           "Silk.NET.Vulkan": "[2.23.0, )",
+          "Silk.NET.Vulkan.Extensions.EXT": "[2.23.0, )",
           "Silk.NET.Vulkan.Extensions.KHR": "[2.23.0, )",
           "Silk.NET.Windowing": "[2.23.0, )"
         }
@@ -103,6 +104,16 @@
           "Silk.NET.Core": "2.23.0"
         }
       },
+      "Silk.NET.Vulkan.Extensions.EXT": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "+Oth189ksRiL6HvGCwIdnsYHawqrbO8y49u1H61z3wsfcHhQZeVDYe/wF5LD7fk3NcdgDvwFD3mLm1QWhdZySw==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
       "Silk.NET.Vulkan.Extensions.KHR": {
         "type": "CentralTransitive",
         "requested": "[2.23.0, )",

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Imports.cs

@@ -338,10 +338,15 @@ public sealed partial class DirectExecutionBackend
 				{
 					orbisGen2Result = DispatchBootstrapBridge();
 				}
-				else if (string.Equals(importStubEntry.Nid, RuntimeStubNids.KernelDynlibDlsym, StringComparison.Ordinal))
+				else if (string.Equals(importStubEntry.Nid, RuntimeStubNids.KernelDynlibDlsym, StringComparison.Ordinal) ||
+					string.Equals(importStubEntry.Nid, "LwG8g3niqwA", StringComparison.Ordinal))
 				{
 					orbisGen2Result = DispatchKernelDynlibDlsym();
 				}
+				else if (string.Equals(importStubEntry.Nid, "r8mvOaWdi28", StringComparison.Ordinal))
+				{
+					orbisGen2Result = DispatchIl2CppApiLookupSymbol();
+				}
 				else if (importStubEntry.Export is { } cachedExport &&
 					(cachedExport.Target & cpuContext.TargetGeneration) != 0)
 				{
@@ -723,6 +728,7 @@ public sealed partial class DirectExecutionBackend
 			"Vo5V8KAwCmk" or // sceSystemServiceHideSplashScreen
 			"TywrFKCoLGY" or // sceSaveDataInitialize3
 			"dyIhnXq-0SM" or // sceSaveDataDirNameSearch
+			"ZP4e7rlzOUk" or // sceSaveDataMount3
 			"ERKzksauAJA" or // sceSaveDataDialogGetStatus
 			"KK3Bdg1RWK0" or // sceSaveDataDialogUpdateStatus
 			"en7gNVnh878" or // sceSaveDataDialogIsReadyToDisplay
@@ -1179,8 +1185,11 @@ public sealed partial class DirectExecutionBackend
 			cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
 			return OrbisGen2Result.ORBIS_GEN2_OK;
 		}
-		if (!TryResolveRuntimeSymbolAddress(symbolName, out var resolvedAddress))
+		if (!TryResolveRuntimeSymbolAddress(symbolName, out var resolvedAddress) &&
+			!TryResolveRuntimeSymbolAlias(symbolName, out resolvedAddress))
 		{
+			Console.Error.WriteLine(
+				$"[LOADER][WARN] sceKernelDlsym failed: handle=0x{cpuContext[CpuRegister.Rdi]:X} symbol='{symbolName}'");
 			cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
 			return OrbisGen2Result.ORBIS_GEN2_OK;
 		}
@@ -1193,6 +1202,62 @@ public sealed partial class DirectExecutionBackend
 		return OrbisGen2Result.ORBIS_GEN2_OK;
 	}
 
+	private bool TryResolveRuntimeSymbolAlias(string symbolName, out ulong address)
+	{
+		address = 0;
+		var alias = symbolName switch
+		{
+			"scriptingGetMem" => "malloc",
+			"scriptingFreeMem" => "free",
+			"scriptingRealloc" => "realloc",
+			"scriptingCalloc" => "calloc",
+			_ => null,
+		};
+
+		return alias != null && TryResolveRuntimeSymbolAddress(alias, out address);
+	}
+
+	private OrbisGen2Result DispatchIl2CppApiLookupSymbol()
+	{
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null)
+		{
+			return OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+		}
+
+		var symbolNameAddress = cpuContext[CpuRegister.Rdi];
+		var outputAddress = cpuContext[CpuRegister.Rsi];
+		if (!TryReadAsciiZ(symbolNameAddress, 512, out var symbolName) ||
+			outputAddress == 0 ||
+			!TryResolveIl2CppApiAddress(symbolName, out var resolvedAddress) ||
+			!TryWriteUInt64Compat(outputAddress, resolvedAddress))
+		{
+			Console.Error.WriteLine(
+				$"[LOADER][WARN] il2cpp_api_lookup_symbol failed: name='{symbolName}' out=0x{outputAddress:X16}");
+			if (outputAddress != 0)
+			{
+				_ = TryWriteUInt64Compat(outputAddress, 0);
+			}
+
+			cpuContext[CpuRegister.Rax] = ulong.MaxValue;
+			return OrbisGen2Result.ORBIS_GEN2_OK;
+		}
+
+		cpuContext[CpuRegister.Rax] = 0;
+		return OrbisGen2Result.ORBIS_GEN2_OK;
+	}
+
+	private bool TryResolveIl2CppApiAddress(string symbolName, out ulong address)
+	{
+		if (TryResolveRuntimeSymbolAddress(symbolName, out address))
+		{
+			return true;
+		}
+
+		return Aerolib.Instance.TryGetByExportName(symbolName, out var symbol) &&
+			TryResolveRuntimeSymbolAddress(symbol.Nid, out address);
+	}
+
 	private OrbisGen2Result DispatchBootstrapBridge()
 	{
 		var cpuContext = ActiveCpuContext;

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.cs

@@ -355,6 +355,8 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 		public GuestThreadRunState State { get; set; }
 
+		public ulong ExitValue { get; set; }
+
 		public string? BlockReason { get; set; }
 
 		public bool HasBlockedContinuation { get; set; }
@@ -1266,7 +1268,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			   libraryName.IndexOf("Kernel", StringComparison.OrdinalIgnoreCase) >= 0;
 	}
 
-	private static bool PreferLleForLibcExport(string exportName)
+	private bool PreferLleForLibcExport(string exportName)
 	{
 		if (string.IsNullOrWhiteSpace(exportName))
 		{
@@ -1287,6 +1289,10 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		{
 			return true;
 		}
+		if (IsLibcAllocatorExport(exportName))
+		{
+			return CanUseLleLibcAllocatorFamily();
+		}
 		if (string.Equals(value, "0", StringComparison.Ordinal))
 		{
 			return true;
@@ -1298,6 +1304,51 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		return IsSafeLleLibcExport(exportName);
 	}
 
+	private bool CanUseLleLibcAllocatorFamily()
+	{
+		return HasUsableLleLibcExport("gQX+4GDQjpM", "malloc") &&
+			   HasUsableLleLibcExport("tIhsqj0qsFE", "free") &&
+			   HasUsableLleLibcExport("2X5agFjKxMc", "calloc") &&
+			   HasUsableLleLibcExport("Y7aJ1uydPMo", "realloc") &&
+			   HasUsableLleLibcExport("Ujf3KzMvRmI", "memalign") &&
+			   HasUsableLleLibcExport("2Btkg8k24Zg", "aligned_alloc") &&
+			   HasUsableLleLibcExport("cVSk9y8URbc", "posix_memalign");
+	}
+
+	private bool HasUsableLleLibcExport(string nid, string exportName)
+	{
+		if (TryResolveRuntimeSymbolAddress(nid, out var address) && IsDirectImportTargetUsable(address))
+		{
+			return true;
+		}
+
+		foreach (var candidate in EnumerateRuntimeSymbolCandidates(exportName))
+		{
+			if (TryResolveRuntimeSymbolAddress(candidate, out address) && IsDirectImportTargetUsable(address))
+			{
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	private static bool IsLibcAllocatorExport(string exportName)
+	{
+		return exportName switch
+		{
+			"malloc" or
+			"free" or
+			"calloc" or
+			"realloc" or
+			"memalign" or
+			"aligned_alloc" or
+			"posix_memalign" or
+			"malloc_usable_size" => true,
+			_ => false,
+		};
+	}
+
 	private static bool IsSafeLleLibcExport(string exportName)
 	{
 		return exportName switch
@@ -2406,6 +2457,69 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 	public bool SupportsGuestContextTransfer => true;
 
+	public bool TryJoinThread(
+		CpuContext callerContext,
+		ulong threadHandle,
+		out ulong returnValue,
+		out string? error)
+	{
+		returnValue = 0;
+		error = null;
+		if (threadHandle == 0)
+		{
+			error = "thread handle is zero";
+			return false;
+		}
+
+		if (threadHandle == GuestThreadExecution.CurrentGuestThreadHandle)
+		{
+			error = "thread cannot join itself";
+			return false;
+		}
+
+		while (!ActiveForcedGuestExit)
+		{
+			Thread? hostThread;
+			lock (_guestThreadGate)
+			{
+				if (!_guestThreads.TryGetValue(threadHandle, out var thread))
+				{
+					error = $"unknown guest thread 0x{threadHandle:X16}";
+					return false;
+				}
+
+				if (thread.State == GuestThreadRunState.Exited)
+				{
+					returnValue = thread.ExitValue;
+					return true;
+				}
+
+				if (thread.State == GuestThreadRunState.Faulted)
+				{
+					error =
+						$"guest thread 0x{threadHandle:X16} faulted: " +
+						(thread.BlockReason ?? "unknown error");
+					return false;
+				}
+
+				hostThread = thread.HostThread;
+			}
+
+			if (hostThread is not null &&
+				!ReferenceEquals(hostThread, Thread.CurrentThread))
+			{
+				hostThread.Join(1);
+			}
+			else
+			{
+				Thread.Sleep(1);
+			}
+		}
+
+		error = "guest execution stopped while joining thread";
+		return false;
+	}
+
 	public void Pump(CpuContext callerContext, string reason)
 	{
 		_ = callerContext;
@@ -3254,6 +3368,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 				switch (exitReason)
 				{
 					case GuestNativeCallExitReason.Returned:
+						thread.ExitValue = thread.Context[CpuRegister.Rax];
 						thread.State = GuestThreadRunState.Exited;
 						break;
 					case GuestNativeCallExitReason.Blocked:

src/SharpEmu.Core/Memory/PhysicalVirtualMemory.cs

@@ -81,7 +81,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterWriteLock();
         try
         {
-            _regions.Add(new MemoryRegion
+            InsertRegionSorted(new MemoryRegion
             {
                 VirtualAddress = actualAddress,
                 Size = alignedSize,
@@ -210,7 +210,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterWriteLock();
         try
         {
-            _regions.Add(new MemoryRegion
+            InsertRegionSorted(new MemoryRegion
             {
                 VirtualAddress = actualAddress,
                 Size = alignedSize,
@@ -473,30 +473,34 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterReadLock();
         try
         {
-            foreach (var region in _regions)
+            var region = FindRegion(virtualAddress, (ulong)destination.Length);
+            if (region is not null &&
+                TryResolveRegionOffset(
+                    virtualAddress,
+                    (ulong)destination.Length,
+                    region,
+                    out var offset))
             {
-                if (TryResolveRegionOffset(virtualAddress, (ulong)destination.Length, region, out var offset))
+                var srcPtr = (void*)(region.VirtualAddress + offset);
+                if (destination.IsEmpty)
                 {
-                    var srcPtr = (void*)(region.VirtualAddress + offset);
-                    if (destination.IsEmpty)
-                    {
-                        return true;
-                    }
+                    return true;
+                }
 
-                    if (region.IsReservedOnly)
+                if (region.IsReservedOnly)
+                {
+                    if (!EnsureRangeCommitted((ulong)srcPtr, (ulong)destination.Length, region))
                     {
-                        if (!EnsureRangeCommitted((ulong)srcPtr, (ulong)destination.Length, region))
-                        {
-                            return false;
-                        }
-                    }
-
-                    if (!CanReadWithoutProtectionChange((ulong)srcPtr, (ulong)destination.Length, region))
-                    {
-                        requiresExclusiveAccess = true;
-                        break;
+                        return false;
                     }
+                }
 
+                if (!CanReadWithoutProtectionChange((ulong)srcPtr, (ulong)destination.Length, region))
+                {
+                    requiresExclusiveAccess = true;
+                }
+                else
+                {
                     fixed (byte* destPtr = destination)
                     {
                         Buffer.MemoryCopy(srcPtr, destPtr, (nuint)destination.Length, (nuint)destination.Length);
@@ -533,30 +537,34 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterReadLock();
         try
         {
-            foreach (var region in _regions)
+            var region = FindRegion(virtualAddress, (ulong)source.Length);
+            if (region is not null &&
+                TryResolveRegionOffset(
+                    virtualAddress,
+                    (ulong)source.Length,
+                    region,
+                    out var offset))
             {
-                if (TryResolveRegionOffset(virtualAddress, (ulong)source.Length, region, out var offset))
+                var destPtr = (void*)(region.VirtualAddress + offset);
+                if (source.IsEmpty)
                 {
-                    var destPtr = (void*)(region.VirtualAddress + offset);
-                    if (source.IsEmpty)
-                    {
-                        return true;
-                    }
+                    return true;
+                }
 
-                    if (region.IsReservedOnly)
+                if (region.IsReservedOnly)
+                {
+                    if (!EnsureRangeCommitted((ulong)destPtr, (ulong)source.Length, region))
                     {
-                        if (!EnsureRangeCommitted((ulong)destPtr, (ulong)source.Length, region))
-                        {
-                            return false;
-                        }
-                    }
-
-                    if (!CanWriteWithoutProtectionChange((ulong)destPtr, (ulong)source.Length, region))
-                    {
-                        requiresExclusiveAccess = true;
-                        break;
+                        return false;
                     }
+                }
 
+                if (!CanWriteWithoutProtectionChange((ulong)destPtr, (ulong)source.Length, region))
+                {
+                    requiresExclusiveAccess = true;
+                }
+                else
+                {
                     fixed (byte* srcPtr = source)
                     {
                         Buffer.MemoryCopy(srcPtr, destPtr, (nuint)source.Length, (nuint)source.Length);
@@ -589,13 +597,14 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
     private bool TryReadExclusive(ulong virtualAddress, Span<byte> destination)
     {
-        foreach (var region in _regions)
+        var region = FindRegion(virtualAddress, (ulong)destination.Length);
+        if (region is not null &&
+            TryResolveRegionOffset(
+                virtualAddress,
+                (ulong)destination.Length,
+                region,
+                out var offset))
         {
-            if (!TryResolveRegionOffset(virtualAddress, (ulong)destination.Length, region, out var offset))
-            {
-                continue;
-            }
-
             var srcPtr = (void*)(region.VirtualAddress + offset);
             if (!EnsureRangeCommitted((ulong)srcPtr, (ulong)destination.Length, region))
             {
@@ -637,13 +646,14 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
     private bool TryWriteExclusive(ulong virtualAddress, ReadOnlySpan<byte> source)
     {
-        foreach (var region in _regions)
+        var region = FindRegion(virtualAddress, (ulong)source.Length);
+        if (region is not null &&
+            TryResolveRegionOffset(
+                virtualAddress,
+                (ulong)source.Length,
+                region,
+                out var offset))
         {
-            if (!TryResolveRegionOffset(virtualAddress, (ulong)source.Length, region, out var offset))
-            {
-                continue;
-            }
-
             var destPtr = (void*)(region.VirtualAddress + offset);
             if (!EnsureRangeCommitted((ulong)destPtr, (ulong)source.Length, region))
             {
@@ -699,15 +709,9 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterReadLock();
         try
         {
-            foreach (var region in _regions)
-            {
-                if (virtualAddress >= region.VirtualAddress &&
-                    virtualAddress < region.VirtualAddress + region.Size)
-                {
-                    return (void*)virtualAddress;
-                }
-            }
-            return null;
+            return FindRegion(virtualAddress, 1) is not null
+                ? (void*)virtualAddress
+                : null;
         }
         finally
         {
@@ -720,14 +724,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterReadLock();
         try
         {
-            foreach (var region in _regions)
-            {
-                if (TryResolveRegionOffset(virtualAddress, size, region, out _))
-                {
-                    return true;
-                }
-            }
-            return false;
+            return FindRegion(virtualAddress, size) is not null;
         }
         finally
         {
@@ -737,14 +734,48 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
     private MemoryRegion? FindRegion(ulong address, ulong size)
     {
-        foreach (var region in _regions)
+        var low = 0;
+        var high = _regions.Count - 1;
+        MemoryRegion? candidate = null;
+        while (low <= high)
         {
-            if (TryResolveRegionOffset(address, size, region, out _))
+            var middle = low + ((high - low) >> 1);
+            var region = _regions[middle];
+            if (region.VirtualAddress <= address)
             {
-                return region;
+                candidate = region;
+                low = middle + 1;
+            }
+            else
+            {
+                high = middle - 1;
             }
         }
-        return null;
+
+        return candidate is not null &&
+            TryResolveRegionOffset(address, size, candidate, out _)
+                ? candidate
+                : null;
+    }
+
+    private void InsertRegionSorted(MemoryRegion region)
+    {
+        var low = 0;
+        var high = _regions.Count;
+        while (low < high)
+        {
+            var middle = low + ((high - low) >> 1);
+            if (_regions[middle].VirtualAddress < region.VirtualAddress)
+            {
+                low = middle + 1;
+            }
+            else
+            {
+                high = middle;
+            }
+        }
+
+        _regions.Insert(low, region);
     }
 
     private bool TryGetOverlappingRegionEnd(ulong address, ulong size, out ulong overlapEnd)

src/SharpEmu.Core/Runtime/SharpEmuRuntime.cs

@@ -543,6 +543,7 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
         {
             Path.Combine(ebootDirectory, "sce_module"),
             Path.Combine(ebootDirectory, "sce_modules"),
+            Path.Combine(ebootDirectory, "Media", "Modules"),
         }
         .Distinct(StringComparer.OrdinalIgnoreCase)
         .Where(Directory.Exists)
@@ -554,7 +555,9 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
         }
 
         var allModulePaths = moduleDirectories
-            .SelectMany(Directory.EnumerateFiles)
+            .SelectMany(directory => Directory
+                .EnumerateFiles(directory)
+                .OrderBy(path => path, StringComparer.OrdinalIgnoreCase))
             .Where(path =>
             {
                 var extension = Path.GetExtension(path);
@@ -562,7 +565,6 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
                        string.Equals(extension, ".sprx", StringComparison.OrdinalIgnoreCase);
             })
             .Distinct(StringComparer.OrdinalIgnoreCase)
-            .OrderBy(path => path, StringComparer.OrdinalIgnoreCase)
             .ToArray();
 
         var modulePaths = allModulePaths

src/SharpEmu.Core/packages.lock.json

@@ -72,6 +72,7 @@
         "dependencies": {
           "SharpEmu.HLE": "[1.0.0, )",
           "Silk.NET.Vulkan": "[2.23.0, )",
+          "Silk.NET.Vulkan.Extensions.EXT": "[2.23.0, )",
           "Silk.NET.Vulkan.Extensions.KHR": "[2.23.0, )",
           "Silk.NET.Windowing": "[2.23.0, )"
         }
@@ -88,6 +89,16 @@
           "Silk.NET.Core": "2.23.0"
         }
       },
+      "Silk.NET.Vulkan.Extensions.EXT": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "+Oth189ksRiL6HvGCwIdnsYHawqrbO8y49u1H61z3wsfcHhQZeVDYe/wF5LD7fk3NcdgDvwFD3mLm1QWhdZySw==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
       "Silk.NET.Vulkan.Extensions.KHR": {
         "type": "CentralTransitive",
         "requested": "[2.23.0, )",

src/SharpEmu.HLE/GuestThreadExecution.cs

@@ -29,6 +29,12 @@ public interface IGuestThreadScheduler
 
     bool TryStartThread(CpuContext creatorContext, GuestThreadStartRequest request, out string? error);
 
+    bool TryJoinThread(
+        CpuContext callerContext,
+        ulong threadHandle,
+        out ulong returnValue,
+        out string? error);
+
     void Pump(CpuContext callerContext, string reason);
 
     int WakeBlockedThreads(string wakeKey, int maxCount = int.MaxValue);

src/SharpEmu.Libs/Agc/AgcExports.cs

@@ -142,7 +142,7 @@ public static class AgcExports
     private static readonly HashSet<uint> _tracedDcbSizes = new();
     private static readonly HashSet<(ulong Es, ulong Ps, GuestDrawKind Kind)> _tracedShaderTranslations = new();
     private static readonly HashSet<(ulong Es, ulong Ps)> _tracedShaderDecodePairs = new();
-    private static readonly HashSet<(ulong Es, ulong Ps, ulong Target)> _tracedShaderDraws = new();
+    private static readonly HashSet<(ulong Es, ulong Ps, ulong Target, ulong Texture, uint VertexCount)> _tracedShaderDraws = new();
     private static readonly HashSet<(ulong Ps, string Error)> _tracedShaderFailures = new();
     private static readonly HashSet<(int Handle, int Index, ulong Address, string Path)> _tracedDisplayBuffers = new();
     private static readonly HashSet<ulong> _tracedComputeShaders = new();
@@ -155,6 +155,16 @@ public static class AgcExports
         (ulong Cs, ulong State, uint LocalX, uint LocalY, uint LocalZ),
         byte[]> _computeSpirvCache = new();
     private static readonly Dictionary<ulong, ulong> _shaderHeadersByCode = new();
+    private static readonly bool _traceAgc = string.Equals(
+        Environment.GetEnvironmentVariable("SHARPEMU_LOG_AGC"),
+        "1",
+        StringComparison.Ordinal);
+    private static readonly bool _traceAgcShader =
+        _traceAgc ||
+        string.Equals(
+            Environment.GetEnvironmentVariable("SHARPEMU_LOG_AGC_SHADER"),
+            "1",
+            StringComparison.Ordinal);
     private static long _dcbWriteDataTraceCount;
     private static long _dcbWaitRegMemTraceCount;
     private static long _createShaderTraceCount;
@@ -1194,6 +1204,51 @@ public static class AgcExports
         return ReturnPointer(ctx, commandAddress);
     }
 
+    [SysAbiExport(
+        Nid = "q88lQ+GP5Yk",
+        ExportName = "sceAgcDcbDrawIndex",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAgc")]
+    public static int DcbDrawIndex(CpuContext ctx)
+    {
+        var commandBufferAddress = ctx[CpuRegister.Rdi];
+        var indexCount = (uint)ctx[CpuRegister.Rsi];
+        var indexAddress = ctx[CpuRegister.Rdx];
+        var modifier = (uint)ctx[CpuRegister.Rcx];
+
+        if (commandBufferAddress == 0 || modifier != 0x4000_0000)
+        {
+            return ReturnPointer(ctx, 0);
+        }
+
+        if (!TryAllocateCommandDwords(ctx, commandBufferAddress, 5, out var baseCommand) ||
+            !TryWriteUInt32(ctx, baseCommand, Pm4(3, ItIndexBase, 0)) ||
+            !TryWriteUInt32(ctx, baseCommand + 4, (uint)indexAddress) ||
+            !TryWriteUInt32(ctx, baseCommand + 8, (uint)(indexAddress >> 32)) ||
+            !TryWriteUInt32(ctx, baseCommand + 12, Pm4(2, ItIndexBufferSize, 0)) ||
+            !TryWriteUInt32(ctx, baseCommand + 16, indexCount))
+        {
+            return ReturnPointer(ctx, 0);
+        }
+
+        if (!TryAllocateCommandDwords(ctx, commandBufferAddress, 5, out var drawCommand) ||
+            !TryWriteUInt32(ctx, drawCommand, Pm4(5, ItDrawIndex2, 0)) ||
+            !TryWriteUInt32(ctx, drawCommand + 4, indexCount) ||
+            !TryWriteUInt32(ctx, drawCommand + 8, 0) ||
+            !TryWriteUInt32(ctx, drawCommand + 12, 0) ||
+            !TryWriteUInt32(ctx, drawCommand + 16, 0))
+        {
+            return ReturnPointer(ctx, 0);
+        }
+
+        TraceAgc(
+            $"agc.dcb_draw_index buf=0x{commandBufferAddress:X16} " +
+            $"base=0x{baseCommand:X16} draw=0x{drawCommand:X16} " +
+            $"count={indexCount} index=0x{indexAddress:X16}");
+
+        return ReturnPointer(ctx, drawCommand);
+    }
+
     [SysAbiExport(
         Nid = "Yw0jKSqop+E",
         ExportName = "sceAgcDcbDrawIndexAuto",
@@ -1996,6 +2051,88 @@ public static class AgcExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+    Nid = "uJziRsODk1c",
+    ExportName = "sceAgcDriverGetResourceRegistrationMaxNameLength",
+    Target = Generation.Gen5,
+    LibraryName = "libSceAgc")]
+    public static int DriverGetResourceRegistrationMaxNameLength(CpuContext ctx)
+    {
+        var outAddress = ctx[CpuRegister.Rdi];
+
+        if (outAddress == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!TryWriteUInt32(ctx, outAddress, 256))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceAgc($"agc.driver_get_resource_registration_max_name_length out=0x{outAddress:X16} value=256");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    private const uint DefaultAgcOwner = 1;
+    [SysAbiExport(
+        Nid = "F0ZXt5q0ZTA",
+        ExportName = "sceAgcDriverGetDefaultOwner",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAgc")]
+    public static int DriverGetDefaultOwner(CpuContext ctx)
+    {
+        var ownerAddress = ctx[CpuRegister.Rdi];
+
+        if (ownerAddress == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!TryWriteUInt32(ctx, ownerAddress, DefaultAgcOwner))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceAgc($"agc.driver_get_default_owner out=0x{ownerAddress:X16} owner={DefaultAgcOwner}");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+    Nid = "W5z4eZrjEas",
+    ExportName = "sceAgcDriverRegisterResource",
+    Target = Generation.Gen5,
+    LibraryName = "libSceAgc")]
+    public static int DriverRegisterResource(CpuContext ctx)
+    {
+        var resourceAddress = ctx[CpuRegister.Rdi];
+        var owner = (uint)ctx[CpuRegister.Rsi];
+        var nameAddress = ctx[CpuRegister.Rdx];
+        var type = (uint)ctx[CpuRegister.R8];
+        var flags = (uint)ctx[CpuRegister.R9];
+
+        TraceAgc(
+            $"agc.driver_register_resource resource=0x{resourceAddress:X16} owner={owner} " +
+            $"name=0x{nameAddress:X16} type={type} flags={flags}");
+
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+    Nid = "-KRzWekV120",
+    ExportName = "sceAgcDriverUnknown_KRzWekV120",
+    Target = Generation.Gen5,
+    LibraryName = "libSceAgc")]
+    public static int DriverUnknownKRzWekV120(CpuContext ctx)
+    {
+        TraceAgc(
+            $"agc.driver_unknown_krz rdi=0x{ctx[CpuRegister.Rdi]:X16} " +
+            $"rsi=0x{ctx[CpuRegister.Rsi]:X16} rdx=0x{ctx[CpuRegister.Rdx]:X16} " +
+            $"rcx=0x{ctx[CpuRegister.Rcx]:X16} r8=0x{ctx[CpuRegister.R8]:X16} r9=0x{ctx[CpuRegister.R9]:X16}");
+
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
     [SysAbiExport(
         Nid = "h9z6+0hEydk",
         ExportName = "sceAgcSuspendPoint",
@@ -2788,7 +2925,7 @@ public static class AgcExports
                 $"ps=0x{(hasPixelShader ? pixelShaderAddress : 0):X16}");
         }
 
-        if (vertexCount is not (3 or 4 or 6))
+        if (vertexCount == 0 || vertexCount > 1_048_576)
         {
             return;
         }
@@ -2872,8 +3009,9 @@ public static class AgcExports
 
             lock (_submitTraceGate)
             {
+                var firstTextureAddress = translatedDraw.Textures.FirstOrDefault()?.Descriptor.Address ?? 0;
                 if (_tracedShaderDraws.Add(
-                        (exportShaderAddress, pixelShaderAddress, firstTarget.Address)))
+                        (exportShaderAddress, pixelShaderAddress, firstTarget.Address, firstTextureAddress, vertexCount)))
                 {
                     TraceTranslatedGuestDraw(
                         ctx,
@@ -3033,6 +3171,11 @@ public static class AgcExports
                 return false;
             }
 
+            TraceAgcShader(
+                $"agc.texture_binding ps=0x{pixelShaderAddress:X16} es=0x{exportShaderAddress:X16} " +
+                $"pc=0x{binding.Pc:X} op={binding.Opcode} storage={(Gen5ShaderTranslator.IsStorageImageOperation(binding.Opcode) ? 1 : 0)} " +
+                $"decoded={FormatTextureDescriptor(texture)} " +
+                $"raw={FormatShaderDwords(binding.ResourceDescriptor)} sampler={FormatShaderDwords(binding.SamplerDescriptor)}");
             textures.Add(
                 new TranslatedImageBinding(
                     texture,
@@ -3477,7 +3620,8 @@ public static class AgcExports
                 ',',
                 draw.VertexInputs.Select(input =>
                     $"{input.Location}:pc=0x{input.Pc:X}:0x{input.BaseAddress:X16}" +
-                    $":stride{input.Stride}:off{input.OffsetBytes}:c{input.ComponentCount}"));
+                    $":stride{input.Stride}:off{input.OffsetBytes}:c{input.ComponentCount}" +
+                    $":fmt{input.DataFormat}/num{input.NumberFormat}"));
         var scissor = draw.RenderState.Scissor is { } drawScissor
             ? $"{drawScissor.X},{drawScissor.Y},{drawScissor.Width}x{drawScissor.Height}"
             : "full";
@@ -3486,6 +3630,29 @@ public static class AgcExports
               $"{drawViewport.Width:0.###}x{drawViewport.Height:0.###}:" +
               $"{drawViewport.MinDepth:0.###}-{drawViewport.MaxDepth:0.###}"
             : "full";
+        var rasterRegisters = new (string Name, uint Offset)[]
+        {
+            ("screen_tl", PaScScreenScissorTl),
+            ("screen_br", PaScScreenScissorBr),
+            ("window_off", PaScWindowOffset),
+            ("window_tl", PaScWindowScissorTl),
+            ("window_br", PaScWindowScissorBr),
+            ("generic_tl", PaScGenericScissorTl),
+            ("generic_br", PaScGenericScissorBr),
+            ("vport_tl", PaScVportScissor0Tl),
+            ("vport_br", PaScVportScissor0Br),
+            ("mode", PaScModeCntl0),
+            ("xscale", PaClVportXScale),
+            ("xoffset", PaClVportXOffset),
+            ("yscale", PaClVportYScale),
+            ("yoffset", PaClVportYOffset),
+        };
+        var raster = string.Join(
+            ',',
+            rasterRegisters.Select(entry =>
+                state.CxRegisters.TryGetValue(entry.Offset, out var value)
+                    ? $"{entry.Name}=0x{value:X8}"
+                    : $"{entry.Name}=missing"));
         var blend = draw.RenderState.Blend;
         TraceAgcShader(
             $"agc.shader_draw es=0x{draw.ExportShaderAddress:X16} " +
@@ -3493,6 +3660,7 @@ public static class AgcExports
             $"primitive=0x{draw.PrimitiveType:X} " +
             $"blend={(blend.Enable ? 1 : 0)}:{blend.ColorSrcFactor}/{blend.ColorDstFactor}/{blend.ColorFunc} " +
             $"write_mask=0x{blend.WriteMask:X} scissor={scissor} viewport={viewport} " +
+            $"raster=[{raster}] " +
             $"ps_ena=0x{psInputEna:X8} ps_addr=0x{psInputAddr:X8} " +
             $"targets=[{targets}] textures=[{textures}] " +
             $"buffers=[{buffers}] vertex=[{vertexInputs}] indices=[{indices}]");
@@ -3550,6 +3718,8 @@ public static class AgcExports
             buffers[index] = new VulkanGuestVertexBuffer(
                 binding.Location,
                 binding.ComponentCount,
+                binding.DataFormat,
+                binding.NumberFormat,
                 binding.BaseAddress,
                 binding.Stride,
                 binding.OffsetBytes,
@@ -3579,7 +3749,10 @@ public static class AgcExports
         }
 
         var sourceWidth = descriptor.TileMode == 0
-            ? Math.Max(descriptor.Width, descriptor.Pitch)
+            ? GetLinearTexturePitch(
+                Math.Max(descriptor.Width, descriptor.Pitch),
+                descriptor.Height,
+                descriptor.Format)
             : descriptor.Width;
         var sourceByteCount = GetTextureByteCount(
             descriptor.Format,
@@ -3593,6 +3766,31 @@ public static class AgcExports
             return true;
         }
 
+        if (!isStorage &&
+            descriptor.Address != 0 &&
+            VulkanVideoPresenter.IsGuestImageAvailable(
+                descriptor.Address,
+                descriptor.Format,
+                descriptor.NumberType))
+        {
+            texture = new VulkanGuestDrawTexture(
+                descriptor.Address,
+                descriptor.Width,
+                descriptor.Height,
+                descriptor.Format,
+                descriptor.NumberType,
+                [],
+                IsFallback: false,
+                IsStorage: false,
+                MipLevels: descriptor.MipLevels,
+                MipLevel: mipLevel,
+                Pitch: sourceWidth,
+                TileMode: descriptor.TileMode,
+                DstSelect: descriptor.DstSelect,
+                Sampler: ToVulkanSampler(samplerDescriptor));
+            return true;
+        }
+
         if (isStorage)
         {
             var initialPixels = Array.Empty<byte>();
@@ -3617,7 +3815,7 @@ public static class AgcExports
                 IsStorage: true,
                 MipLevels: descriptor.MipLevels,
                 MipLevel: mipLevel,
-                Pitch: descriptor.Pitch,
+                Pitch: sourceWidth,
                 TileMode: descriptor.TileMode,
                 DstSelect: descriptor.DstSelect,
                 Sampler: ToVulkanSampler(samplerDescriptor));
@@ -3663,7 +3861,7 @@ public static class AgcExports
             IsStorage: isStorage,
             MipLevels: descriptor.MipLevels,
             MipLevel: mipLevel,
-            Pitch: descriptor.Pitch,
+            Pitch: sourceWidth,
             TileMode: descriptor.TileMode,
             DstSelect: descriptor.DstSelect,
             Sampler: ToVulkanSampler(samplerDescriptor));
@@ -4326,6 +4524,28 @@ public static class AgcExports
             : checked(((ulong)width + 3) / 4 * (((ulong)height + 3) / 4) * blockBytes);
     }
 
+    private static uint GetLinearTexturePitch(uint pitch, uint height, uint format)
+    {
+        var bytesPerTexel = GetTextureBytesPerTexel(format);
+        if (bytesPerTexel == 0 || height == 0)
+        {
+            return pitch;
+        }
+
+        var pitchAlignment = Math.Max(8UL, 64UL / bytesPerTexel);
+        var alignedPitch = AlignUp(pitch, pitchAlignment);
+        var sliceAlignment = Math.Max(64UL, 256UL / bytesPerTexel);
+        while ((alignedPitch * height) % sliceAlignment != 0)
+        {
+            alignedPitch += pitchAlignment;
+        }
+
+        return checked((uint)alignedPitch);
+    }
+
+    private static ulong AlignUp(ulong value, ulong alignment) =>
+        (value + alignment - 1) & ~(alignment - 1);
+
     private static void TraceShaderTranslationMiss(
         CpuContext ctx,
         SubmittedDcbState state,
@@ -4594,6 +4814,10 @@ public static class AgcExports
             return false;
         }
 
+        // GFX10/RDNA2 T# layout: WIDTH is split across word1[31:30] (lo 2 bits)
+        // and word2[11:0] (hi 12 bits); FORMAT is the combined 9-bit field at
+        // word1[28:20]. Verified against Kyty's decode of the same game
+        // descriptors (fmt=56=8_8_8_8_UNORM, extent 1280x720, sw_mode 27).
         // GNM T# exposes a 38-bit baseaddr256 field, but RPCSX and the
         // Demon's Souls descriptors both show that only the low 32 bits are
         // part of the guest GPU VA. The upper baseaddr bits carry resource
@@ -5343,7 +5567,7 @@ public static class AgcExports
 
     private static void TraceAgc(string message)
     {
-        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_AGC"), "1", StringComparison.Ordinal))
+        if (!_traceAgc)
         {
             return;
         }
@@ -5353,8 +5577,7 @@ public static class AgcExports
 
     private static void TraceAgcShader(string message)
     {
-        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_AGC"), "1", StringComparison.Ordinal) &&
-            !string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_AGC_SHADER"), "1", StringComparison.Ordinal))
+        if (!_traceAgcShader)
         {
             return;
         }
@@ -5367,6 +5590,12 @@ public static class AgcExports
             ? "none"
             : string.Join(',', values.Select(static value => $"{value:X8}"));
 
+    private static string FormatTextureDescriptor(TextureDescriptor descriptor) =>
+        $"addr=0x{descriptor.Address:X16} {descriptor.Width}x{descriptor.Height} " +
+        $"fmt={descriptor.Format} num={descriptor.NumberType} tile={descriptor.TileMode} " +
+        $"type={descriptor.Type} levels={descriptor.BaseLevel}-{descriptor.LastLevel} " +
+        $"pitch={descriptor.Pitch} dst=0x{descriptor.DstSelect:X3}";
+
     private static void DumpSpirv(
         string stage,
         ulong shaderAddress,

src/SharpEmu.Libs/Agc/Gen5ShaderIr.cs

@@ -276,6 +276,8 @@ internal sealed record Gen5VertexInputBinding(
     uint Pc,
     uint Location,
     uint ComponentCount,
+    uint DataFormat,
+    uint NumberFormat,
     ulong BaseAddress,
     uint Stride,
     uint OffsetBytes,

src/SharpEmu.Libs/Agc/Gen5ShaderScalarEvaluator.cs

@@ -20,7 +20,9 @@ internal static class Gen5ShaderScalarEvaluator
         ulong BaseAddress,
         uint Stride,
         uint NumRecords,
-        ulong SizeBytes);
+        ulong SizeBytes,
+        uint NumberFormat,
+        uint DataFormat);
 
     public static bool TryResolveImageBindings(
         CpuContext ctx,
@@ -400,14 +402,21 @@ internal static class Gen5ShaderScalarEvaluator
             return false;
         }
 
+        var bindingData = data;
+        var bindingStride = descriptor.Stride;
+        var bindingOffset = unchecked((uint)control.OffsetBytes + scalarOffset);
+        var bindingDataFormat = descriptor.DataFormat;
+        var bindingNumberFormat = descriptor.NumberFormat;
         binding = new Gen5VertexInputBinding(
             instruction.Pc,
             location,
             control.DwordCount,
+            bindingDataFormat,
+            bindingNumberFormat,
             descriptor.BaseAddress,
-            descriptor.Stride,
-            unchecked((uint)control.OffsetBytes + scalarOffset),
-            data);
+            bindingStride,
+            bindingOffset,
+            bindingData);
         return true;
     }
 
@@ -803,7 +812,11 @@ internal static class Gen5ShaderScalarEvaluator
                 "SFF1I32B32" => left == 0 ? uint.MaxValue : (uint)BitOperations.TrailingZeroCount(left),
                 _ => registers[destination.Value] | (1u << ((int)left & 31)),
             };
-            scalarConditionCode = registers[destination.Value] != 0;
+            if (instruction.Opcode != "SBitset1B32")
+            {
+                scalarConditionCode = registers[destination.Value] != 0;
+            }
+
             return true;
         }
 
@@ -829,13 +842,15 @@ internal static class Gen5ShaderScalarEvaluator
                 }
             case "SSubU32":
                 result = left - right;
-                scalarConditionCode = left >= right;
+                scalarConditionCode = right > left;
                 break;
             case "SAddI32":
                 result = unchecked((uint)((int)left + (int)right));
+                scalarConditionCode = SignedAddOverflow(left, right, result);
                 break;
             case "SSubI32":
                 result = unchecked((uint)((int)left - (int)right));
+                scalarConditionCode = SignedSubOverflow(left, right, result);
                 break;
             case "SAddcU32":
                 {
@@ -846,23 +861,27 @@ internal static class Gen5ShaderScalarEvaluator
                 }
             case "SSubbU32":
                 {
-                    var borrow = scalarConditionCode ? 0UL : 1UL;
+                    var borrow = scalarConditionCode ? 1UL : 0UL;
                     var subtrahend = (ulong)right + borrow;
                     result = unchecked(left - (uint)subtrahend);
-                    scalarConditionCode = left >= subtrahend;
+                    scalarConditionCode = subtrahend > left;
                     break;
                 }
             case "SMinI32":
                 result = unchecked((uint)Math.Min((int)left, (int)right));
+                scalarConditionCode = (int)left < (int)right;
                 break;
             case "SMinU32":
                 result = Math.Min(left, right);
+                scalarConditionCode = left < right;
                 break;
             case "SMaxI32":
                 result = unchecked((uint)Math.Max((int)left, (int)right));
+                scalarConditionCode = (int)left > (int)right;
                 break;
             case "SMaxU32":
                 result = Math.Max(left, right);
+                scalarConditionCode = left > right;
                 break;
             case "SCselectB32":
                 result = scalarConditionCode ? left : right;
@@ -926,6 +945,7 @@ internal static class Gen5ShaderScalarEvaluator
                     var offset = (int)right & 31;
                     var width = Math.Min(((int)right >> 16) & 0x7F, 32 - offset);
                     result = width == 0 ? 0 : left >> offset & (uint.MaxValue >> (32 - width));
+                    scalarConditionCode = result != 0;
                     break;
                 }
             case "SBfeI32":
@@ -935,23 +955,41 @@ internal static class Gen5ShaderScalarEvaluator
                     result = width == 0
                         ? 0
                         : unchecked((uint)(((int)(left << (32 - width - offset))) >> (32 - width)));
+                    scalarConditionCode = result != 0;
                     break;
                 }
             case "SAbsdiffI32":
                 result = unchecked((uint)Math.Abs((long)(int)left - (int)right));
+                scalarConditionCode = result != 0;
                 break;
             case "SLshl1AddU32":
-                result = (left << 1) + right;
-                break;
+                {
+                    var wide = ((ulong)left << 1) + right;
+                    result = (uint)wide;
+                    scalarConditionCode = wide > uint.MaxValue;
+                    break;
+                }
             case "SLshl2AddU32":
-                result = (left << 2) + right;
-                break;
+                {
+                    var wide = ((ulong)left << 2) + right;
+                    result = (uint)wide;
+                    scalarConditionCode = wide > uint.MaxValue;
+                    break;
+                }
             case "SLshl3AddU32":
-                result = (left << 3) + right;
-                break;
+                {
+                    var wide = ((ulong)left << 3) + right;
+                    result = (uint)wide;
+                    scalarConditionCode = wide > uint.MaxValue;
+                    break;
+                }
             case "SLshl4AddU32":
-                result = (left << 4) + right;
-                break;
+                {
+                    var wide = ((ulong)left << 4) + right;
+                    result = (uint)wide;
+                    scalarConditionCode = wide > uint.MaxValue;
+                    break;
+                }
             case "SPackLlB32B16":
                 result = (left & 0xFFFFu) | (right << 16);
                 break;
@@ -993,7 +1031,8 @@ internal static class Gen5ShaderScalarEvaluator
             "SNandSaveexecB64" or
             "SNorSaveexecB64" or
             "SXnorSaveexecB64" or
-            "SAndn1SaveexecB64"))
+            "SAndn1SaveexecB64" or
+            "SOrn1SaveexecB64"))
         {
             return false;
         }
@@ -1021,11 +1060,12 @@ internal static class Gen5ShaderScalarEvaluator
             "SAndSaveexecB64" => oldExec & source,
             "SOrSaveexecB64" => oldExec | source,
             "SXorSaveexecB64" => oldExec ^ source,
-            "SAndn1SaveexecB64" => ~oldExec & source,
-            "SAndn2SaveexecB64" => oldExec & ~source,
-            "SOrn2SaveexecB64" => oldExec | ~source,
-            "SNandSaveexecB64" => ~(oldExec & source),
-            "SNorSaveexecB64" => ~(oldExec | source),
+            "SAndn1SaveexecB64" => ~source & oldExec,
+            "SAndn2SaveexecB64" => source & ~oldExec,
+            "SOrn1SaveexecB64" => ~source | oldExec,
+            "SOrn2SaveexecB64" => source | ~oldExec,
+            "SNandSaveexecB64" => ~(source & oldExec),
+            "SNorSaveexecB64" => ~(source | oldExec),
             _ => ~(oldExec ^ source),
         };
 
@@ -1095,6 +1135,12 @@ internal static class Gen5ShaderScalarEvaluator
 
     private static ulong MaskWaveValue(ulong value) => value & RdnaWaveMask;
 
+    private static bool SignedAddOverflow(uint left, uint right, uint result) =>
+        ((left ^ result) & (right ^ result) & 0x80000000u) != 0;
+
+    private static bool SignedSubOverflow(uint left, uint right, uint result) =>
+        ((left ^ right) & (left ^ result) & 0x80000000u) != 0;
+
     private static bool TryExecuteScalarCompare(
         Gen5ShaderInstruction instruction,
         uint[] registers,
@@ -1416,7 +1462,7 @@ internal static class Gen5ShaderScalarEvaluator
             word2 == 0 &&
             word3 == 0)
         {
-            descriptor = new BufferDescriptor(0, 0, 0, 0);
+            descriptor = new BufferDescriptor(0, 0, 0, 0, 0, 0);
             return true;
         }
 
@@ -1428,19 +1474,64 @@ internal static class Gen5ShaderScalarEvaluator
                 return false;
             }
 
-            descriptor = new BufferDescriptor(0, 0, 0, 0);
+            descriptor = new BufferDescriptor(0, 0, 0, 0, 0, 0);
             return true;
         }
 
-        var baseAddress = word0 | ((ulong)(word1 & 0x0FFFu) << 32);
+        var baseAddress = word0 | ((ulong)(word1 & 0xFFFFu) << 32);
         var stride = (word1 >> 16) & 0x3FFFu;
+        var unifiedFormat = (word3 >> 12) & 0x7Fu;
+        var (dataFormat, numberFormat) =
+            DecodeGfx10BufferFormat(unifiedFormat);
         var sizeBytes = stride == 0
             ? word2
             : (ulong)stride * word2;
-        descriptor = new BufferDescriptor(baseAddress, stride, word2, sizeBytes);
+        descriptor = new BufferDescriptor(baseAddress, stride, word2, sizeBytes, numberFormat, dataFormat);
         return true;
     }
 
+    private static (uint DataFormat, uint NumberFormat)
+        DecodeGfx10BufferFormat(uint format) =>
+        format switch
+        {
+            0 => (0, 0),
+            >= 1 and <= 6 => (1, format - 1),
+            >= 7 and <= 13 => (2, DecodeUnifiedNumber(format - 7, 7)),
+            >= 14 and <= 19 => (3, format - 14),
+            >= 20 and <= 22 => (4, DecodeIntegerOrFloatNumber(format - 20)),
+            >= 23 and <= 29 => (5, DecodeUnifiedNumber(format - 23, 7)),
+            >= 30 and <= 36 => (6, DecodeUnifiedNumber(format - 30, 7)),
+            >= 37 and <= 43 => (7, DecodeUnifiedNumber(format - 37, 7)),
+            >= 44 and <= 49 => (8, format - 44),
+            >= 50 and <= 55 => (9, format - 50),
+            >= 56 and <= 61 => (10, format - 56),
+            >= 62 and <= 64 => (11, DecodeIntegerOrFloatNumber(format - 62)),
+            >= 65 and <= 71 => (12, DecodeUnifiedNumber(format - 65, 7)),
+            >= 72 and <= 74 => (13, DecodeIntegerOrFloatNumber(format - 72)),
+            >= 75 and <= 77 => (14, DecodeIntegerOrFloatNumber(format - 75)),
+            128 => (1, 9),
+            129 => (3, 9),
+            130 => (10, 9),
+            132 => (34, 7),
+            133 => (16, 0),
+            134 => (17, 0),
+            135 => (18, 0),
+            136 => (19, 0),
+            140 => (4, 7),
+            _ => (0, 0),
+        };
+
+    private static uint DecodeUnifiedNumber(uint offset, uint formatCount) =>
+        offset == formatCount - 1 ? 7u : offset;
+
+    private static uint DecodeIntegerOrFloatNumber(uint offset) =>
+        offset switch
+        {
+            0 => 4,
+            1 => 5,
+            _ => 7,
+        };
+
     private static bool TryReadUserDataScalarLoad(
         Gen5ShaderState state,
         Gen5ShaderInstruction instruction,

src/SharpEmu.Libs/Agc/Gen5ShaderTranslator.cs

@@ -4,6 +4,7 @@
 using SharpEmu.HLE;
 using SharpEmu.Libs.VideoOut;
 using System.Buffers.Binary;
+using System.Runtime.CompilerServices;
 using System.Text;
 
 namespace SharpEmu.Libs.Agc;
@@ -13,6 +14,14 @@ internal static class Gen5ShaderTranslator
     private const int MaxInstructions = 4096;
     private const int MinimumUserDataDwords = 16;
     private const int MaximumUserDataDwords = 256;
+    private static readonly ConditionalWeakTable<object, ShaderDecodeCache> _decodeCaches = new();
+
+    private sealed class ShaderDecodeCache
+    {
+        public object Gate { get; } = new();
+        public Dictionary<ulong, Gen5ShaderProgram> Programs { get; } = new();
+        public Dictionary<ulong, Gen5ShaderMetadata?> Metadata { get; } = new();
+    }
 
     private static readonly uint[] FullscreenBarycentricEs =
     [
@@ -117,16 +126,51 @@ internal static class Gen5ShaderTranslator
         uint userDataScalarRegisterBase = 0)
     {
         state = default!;
-        if (!TryDecodeProgram(ctx, shaderAddress, out var program, out error))
+        error = string.Empty;
+        var cache = _decodeCaches.GetValue(ctx.Memory, static _ => new ShaderDecodeCache());
+        Gen5ShaderProgram? program;
+        lock (cache.Gate)
         {
-            return false;
+            cache.Programs.TryGetValue(shaderAddress, out program);
+        }
+
+        if (program is null)
+        {
+            if (!TryDecodeProgram(ctx, shaderAddress, out program, out error))
+            {
+                return false;
+            }
+
+            lock (cache.Gate)
+            {
+                cache.Programs.TryAdd(shaderAddress, program);
+            }
         }
 
         Gen5ShaderMetadata? metadata = null;
-        if (shaderHeaderAddress != 0 &&
-            Gen5ShaderMetadataReader.TryRead(ctx, shaderHeaderAddress, out var decodedMetadata))
+        if (shaderHeaderAddress != 0)
         {
-            metadata = decodedMetadata;
+            var metadataCached = false;
+            lock (cache.Gate)
+            {
+                metadataCached = cache.Metadata.TryGetValue(shaderHeaderAddress, out metadata);
+            }
+
+            if (!metadataCached)
+            {
+                if (Gen5ShaderMetadataReader.TryRead(
+                        ctx,
+                        shaderHeaderAddress,
+                        out var decodedMetadata))
+                {
+                    metadata = decodedMetadata;
+                }
+
+                lock (cache.Gate)
+                {
+                    cache.Metadata.TryAdd(shaderHeaderAddress, metadata);
+                }
+            }
         }
 
         var userData = new uint[GetUserDataDwordCount(metadata)];
@@ -452,6 +496,7 @@ internal static class Gen5ShaderTranslator
             0x2A => "SNorSaveexecB64",
             0x2B => "SXnorSaveexecB64",
             0x37 => "SAndn1SaveexecB64",
+            0x38 => "SOrn1SaveexecB64",
             _ => string.Empty,
         };
 

src/SharpEmu.Libs/Agc/Gen5SpirvTranslator.Alu.cs

@@ -212,12 +212,26 @@ internal static partial class Gen5SpirvTranslator
                 case "VSinF32":
                     result = EmitFloatResult(
                         instruction,
-                        Ext(13, _floatType, GetFloatSource(instruction, 0)));
+                        Ext(
+                            13,
+                            _floatType,
+                            _module.AddInstruction(
+                                SpirvOp.FMul,
+                                _floatType,
+                                GetFloatSource(instruction, 0),
+                                Float(MathF.Tau))));
                     break;
                 case "VCosF32":
                     result = EmitFloatResult(
                         instruction,
-                        Ext(14, _floatType, GetFloatSource(instruction, 0)));
+                        Ext(
+                            14,
+                            _floatType,
+                            _module.AddInstruction(
+                                SpirvOp.FMul,
+                                _floatType,
+                                GetFloatSource(instruction, 0),
+                                Float(MathF.Tau))));
                     break;
                 case "VAddF32":
                     result = EmitFloatBinary(instruction, SpirvOp.FAdd);
@@ -635,13 +649,29 @@ internal static partial class Gen5SpirvTranslator
                         width);
                     break;
                 }
+                case "VBfiB32":
+                {
+                    var mask = GetRawSource(instruction, 0);
+                    var insert = GetRawSource(instruction, 1);
+                    var source = GetRawSource(instruction, 2);
+                    result = _module.AddInstruction(
+                        SpirvOp.BitwiseOr,
+                        _uintType,
+                        BitwiseAnd(mask, insert),
+                        BitwiseAnd(
+                            _module.AddInstruction(SpirvOp.Not, _uintType, mask),
+                            source));
+                    break;
+                }
                 case "VCvtPkrtzF16F32":
                 {
+                    var first = TruncateFloat32ForPack(GetFloatSource(instruction, 0));
+                    var second = TruncateFloat32ForPack(GetFloatSource(instruction, 1));
                     var vector = _module.AddInstruction(
                         SpirvOp.CompositeConstruct,
                         _vec2Type,
-                        GetFloatSource(instruction, 0),
-                        GetFloatSource(instruction, 1));
+                        first,
+                        second);
                     result = Ext(58, _uintType, vector);
                     break;
                 }
@@ -945,6 +975,16 @@ internal static partial class Gen5SpirvTranslator
                     StoreS(destination, result);
                     Store(_scc, IsNotZero(result));
                     return true;
+                case "SBitset1B32":
+                    result = _module.AddInstruction(
+                        SpirvOp.BitFieldInsert,
+                        _uintType,
+                        LoadS(destination),
+                        UInt(1),
+                        BitwiseAnd(left, UInt(31)),
+                        UInt(1));
+                    StoreS(destination, result);
+                    return true;
                 default:
                 {
                     if (instruction.Sources.Count < 2)
@@ -971,13 +1011,14 @@ internal static partial class Gen5SpirvTranslator
                                 left,
                                 right);
                             Store(_scc, _module.AddInstruction(
-                                SpirvOp.UGreaterThanEqual,
+                                SpirvOp.UGreaterThan,
                                 _boolType,
-                                left,
-                                right));
+                                right,
+                                left));
                             break;
                         case "SAddI32":
                             result = IAdd(left, right);
+                            Store(_scc, SignedAddOverflow(left, right, result));
                             break;
                         case "SSubI32":
                             result = _module.AddInstruction(
@@ -985,6 +1026,7 @@ internal static partial class Gen5SpirvTranslator
                                 _uintType,
                                 left,
                                 right);
+                            Store(_scc, SignedSubOverflow(left, right, result));
                             break;
                         case "SAddcU32":
                         {
@@ -1021,8 +1063,8 @@ internal static partial class Gen5SpirvTranslator
                                 SpirvOp.Select,
                                 _uintType,
                                 Load(_boolType, _scc),
-                                UInt(0),
-                                UInt(1));
+                                UInt(1),
+                                UInt(0));
                             var partial = _module.AddInstruction(
                                 SpirvOp.ISub,
                                 _uintType,
@@ -1033,23 +1075,31 @@ internal static partial class Gen5SpirvTranslator
                                 _uintType,
                                 partial,
                                 borrow);
-                            var firstNoBorrow = _module.AddInstruction(
-                                SpirvOp.UGreaterThanEqual,
+                            var firstBorrow = _module.AddInstruction(
+                                SpirvOp.UGreaterThan,
                                 _boolType,
-                                left,
-                                right);
-                            var secondNoBorrow = _module.AddInstruction(
-                                SpirvOp.UGreaterThanEqual,
+                                right,
+                                left);
+                            var secondBorrow = _module.AddInstruction(
+                                SpirvOp.LogicalAnd,
                                 _boolType,
-                                partial,
-                                borrow);
+                                _module.AddInstruction(
+                                    SpirvOp.IEqual,
+                                    _boolType,
+                                    borrow,
+                                    UInt(1)),
+                                _module.AddInstruction(
+                                    SpirvOp.IEqual,
+                                    _boolType,
+                                    right,
+                                    left));
                             Store(
                                 _scc,
                                 _module.AddInstruction(
-                                    SpirvOp.LogicalAnd,
+                                    SpirvOp.LogicalOr,
                                     _boolType,
-                                    firstNoBorrow,
-                                    secondNoBorrow));
+                                    firstBorrow,
+                                    secondBorrow));
                             break;
                         }
                         case "SMulI32":
@@ -1061,6 +1111,7 @@ internal static partial class Gen5SpirvTranslator
                             break;
                         case "SAndB32":
                             result = BitwiseAnd(left, right);
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SOrB32":
                             result = _module.AddInstruction(
@@ -1068,6 +1119,7 @@ internal static partial class Gen5SpirvTranslator
                                 _uintType,
                                 left,
                                 right);
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SXorB32":
                             result = _module.AddInstruction(
@@ -1075,22 +1127,64 @@ internal static partial class Gen5SpirvTranslator
                                 _uintType,
                                 left,
                                 right);
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SAndn2B32":
                             result = BitwiseAnd(
                                 left,
                                 _module.AddInstruction(SpirvOp.Not, _uintType, right));
+                            Store(_scc, IsNotZero(result));
+                            break;
+                        case "SOrn2B32":
+                            result = _module.AddInstruction(
+                                SpirvOp.BitwiseOr,
+                                _uintType,
+                                left,
+                                _module.AddInstruction(SpirvOp.Not, _uintType, right));
+                            Store(_scc, IsNotZero(result));
+                            break;
+                        case "SNandB32":
+                            result = _module.AddInstruction(
+                                SpirvOp.Not,
+                                _uintType,
+                                BitwiseAnd(left, right));
+                            Store(_scc, IsNotZero(result));
+                            break;
+                        case "SNorB32":
+                            result = _module.AddInstruction(
+                                SpirvOp.Not,
+                                _uintType,
+                                _module.AddInstruction(
+                                    SpirvOp.BitwiseOr,
+                                    _uintType,
+                                    left,
+                                    right));
+                            Store(_scc, IsNotZero(result));
+                            break;
+                        case "SXnorB32":
+                            result = _module.AddInstruction(
+                                SpirvOp.Not,
+                                _uintType,
+                                _module.AddInstruction(
+                                    SpirvOp.BitwiseXor,
+                                    _uintType,
+                                    left,
+                                    right));
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SLshlB32":
                             result = ShiftLeftLogical(left, right);
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SLshrB32":
                             result = ShiftRightLogical(
                                 left,
                                 BitwiseAnd(right, UInt(31)));
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SAshrI32":
                             result = ShiftRightArithmetic(left, right);
+                            Store(_scc, IsNotZero(result));
                             break;
                         case "SBfmB32":
                             result = _module.AddInstruction(
@@ -1133,6 +1227,7 @@ internal static partial class Gen5SpirvTranslator
                                     left,
                                     offset,
                                     width);
+                            Store(_scc, IsNotZero(result));
                             break;
                         }
                         case "SCselectB32":
@@ -1145,9 +1240,47 @@ internal static partial class Gen5SpirvTranslator
                             break;
                         case "SMinU32":
                             result = Ext(38, _uintType, left, right);
+                            Store(
+                                _scc,
+                                _module.AddInstruction(
+                                    SpirvOp.ULessThan,
+                                    _boolType,
+                                    left,
+                                    right));
+                            break;
+                        case "SMinI32":
+                            result = Bitcast(
+                                _uintType,
+                                Ext(39, _intType, Bitcast(_intType, left), Bitcast(_intType, right)));
+                            Store(
+                                _scc,
+                                _module.AddInstruction(
+                                    SpirvOp.SLessThan,
+                                    _boolType,
+                                    Bitcast(_intType, left),
+                                    Bitcast(_intType, right)));
                             break;
                         case "SMaxU32":
                             result = Ext(41, _uintType, left, right);
+                            Store(
+                                _scc,
+                                _module.AddInstruction(
+                                    SpirvOp.UGreaterThan,
+                                    _boolType,
+                                    left,
+                                    right));
+                            break;
+                        case "SMaxI32":
+                            result = Bitcast(
+                                _uintType,
+                                Ext(42, _intType, Bitcast(_intType, left), Bitcast(_intType, right)));
+                            Store(
+                                _scc,
+                                _module.AddInstruction(
+                                    SpirvOp.SGreaterThan,
+                                    _boolType,
+                                    Bitcast(_intType, left),
+                                    Bitcast(_intType, right)));
                             break;
                         case "SLshl1AddU32":
                         case "SLshl2AddU32":
@@ -1292,17 +1425,55 @@ internal static partial class Gen5SpirvTranslator
                     "SXorSaveexecB64" => _module.AddInstruction(
                         SpirvOp.BitwiseXor, _ulongType, oldExec, left),
                     "SAndn2SaveexecB64" => _module.AddInstruction(
-                        SpirvOp.BitwiseAnd, _ulongType, oldExec, notLeft),
-                    "SAndn1SaveexecB64" => _module.AddInstruction(
                         SpirvOp.BitwiseAnd,
                         _ulongType,
+                        left,
                         _module.AddInstruction(
                             SpirvOp.Not,
                             _ulongType,
-                            oldExec),
-                        left),
+                            oldExec)),
+                    "SAndn1SaveexecB64" => _module.AddInstruction(
+                        SpirvOp.BitwiseAnd,
+                        _ulongType,
+                        notLeft,
+                        oldExec),
+                    "SOrn1SaveexecB64" => _module.AddInstruction(
+                        SpirvOp.BitwiseOr,
+                        _ulongType,
+                        notLeft,
+                        oldExec),
                     "SOrn2SaveexecB64" => _module.AddInstruction(
-                        SpirvOp.BitwiseOr, _ulongType, oldExec, notLeft),
+                        SpirvOp.BitwiseOr,
+                        _ulongType,
+                        left,
+                        _module.AddInstruction(
+                            SpirvOp.Not,
+                            _ulongType,
+                            oldExec)),
+                    "SNandSaveexecB64" => _module.AddInstruction(
+                        SpirvOp.Not,
+                        _ulongType,
+                        _module.AddInstruction(
+                            SpirvOp.BitwiseAnd,
+                            _ulongType,
+                            left,
+                            oldExec)),
+                    "SNorSaveexecB64" => _module.AddInstruction(
+                        SpirvOp.Not,
+                        _ulongType,
+                        _module.AddInstruction(
+                            SpirvOp.BitwiseOr,
+                            _ulongType,
+                            left,
+                            oldExec)),
+                    "SXnorSaveexecB64" => _module.AddInstruction(
+                        SpirvOp.Not,
+                        _ulongType,
+                        _module.AddInstruction(
+                            SpirvOp.BitwiseXor,
+                            _ulongType,
+                            left,
+                            oldExec)),
                     _ => 0u,
                 };
                 if (newExec == 0)
@@ -1508,6 +1679,22 @@ internal static partial class Gen5SpirvTranslator
             }
 
             StoreS64(destination, value);
+            if (instruction.Opcode is
+                "SNotB64" or
+                "SAndB64" or
+                "SOrB64" or
+                "SXorB64" or
+                "SAndn1B64" or
+                "SAndn2B64" or
+                "SOrn1B64" or
+                "SOrn2B64" or
+                "SNandB64" or
+                "SNorB64" or
+                "SXnorB64")
+            {
+                Store(_scc, IsNotZero64(value));
+            }
+
             return true;
         }
 
@@ -2067,6 +2254,14 @@ internal static partial class Gen5SpirvTranslator
             return Bitcast(_uintType, value);
         }
 
+        private uint TruncateFloat32ForPack(uint value)
+        {
+            var raw = BitwiseAnd(
+                Bitcast(_uintType, value),
+                UInt(0xFFFF_E000));
+            return Bitcast(_floatType, raw);
+        }
+
         private uint Ext(uint operation, uint resultType, params uint[] operands)
         {
             var values = new uint[2 + operands.Length];
@@ -2086,6 +2281,53 @@ internal static partial class Gen5SpirvTranslator
                 value,
                 _module.Constant64(_ulongType, 0));
 
+        private uint SignBit(uint value) =>
+            ShiftRightLogical(value, UInt(31));
+
+        private uint SignedAddOverflow(uint left, uint right, uint result)
+        {
+            var leftSign = SignBit(left);
+            var rightSign = SignBit(right);
+            var resultSign = SignBit(result);
+            var sameSourceSign = _module.AddInstruction(
+                SpirvOp.IEqual,
+                _boolType,
+                leftSign,
+                rightSign);
+            var resultSignChanged = _module.AddInstruction(
+                SpirvOp.INotEqual,
+                _boolType,
+                leftSign,
+                resultSign);
+            return _module.AddInstruction(
+                SpirvOp.LogicalAnd,
+                _boolType,
+                sameSourceSign,
+                resultSignChanged);
+        }
+
+        private uint SignedSubOverflow(uint left, uint right, uint result)
+        {
+            var leftSign = SignBit(left);
+            var rightSign = SignBit(right);
+            var resultSign = SignBit(result);
+            var differentSourceSign = _module.AddInstruction(
+                SpirvOp.INotEqual,
+                _boolType,
+                leftSign,
+                rightSign);
+            var resultSignChanged = _module.AddInstruction(
+                SpirvOp.INotEqual,
+                _boolType,
+                leftSign,
+                resultSign);
+            return _module.AddInstruction(
+                SpirvOp.LogicalAnd,
+                _boolType,
+                differentSourceSign,
+                resultSignChanged);
+        }
+
         private static bool TryDecodeInlineConstant(uint encoded, out uint value)
         {
             if (encoded == 125)

src/SharpEmu.Libs/Audio/AudioOutExports.cs

@@ -0,0 +1,92 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Collections.Concurrent;
+using System.Threading;
+
+namespace SharpEmu.Libs.Audio;
+
+public static class AudioOutExports
+{
+    private static readonly ConcurrentDictionary<int, PortState> Ports = new();
+    private static int _nextPortHandle;
+
+    private sealed record PortState(int UserId, int Type, uint BufferLength, uint Frequency, int Format);
+
+    [SysAbiExport(
+        Nid = "JfEPXVxhFqA",
+        ExportName = "sceAudioOutInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAudioOut")]
+    public static int AudioOutInit(CpuContext ctx) => SetReturn(ctx, 0);
+
+    [SysAbiExport(
+        Nid = "ekNvsT22rsY",
+        ExportName = "sceAudioOutOpen",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAudioOut")]
+    public static int AudioOutOpen(CpuContext ctx)
+    {
+        var userId = unchecked((int)ctx[CpuRegister.Rdi]);
+        var type = unchecked((int)ctx[CpuRegister.Rsi]);
+        var bufferLength = unchecked((uint)ctx[CpuRegister.Rcx]);
+        var frequency = unchecked((uint)ctx[CpuRegister.R8]);
+        var format = unchecked((int)ctx[CpuRegister.R9]);
+        if (bufferLength == 0 || frequency == 0)
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        var handle = Interlocked.Increment(ref _nextPortHandle);
+        Ports[handle] = new PortState(userId, type, bufferLength, frequency, format);
+        return SetReturn(ctx, handle);
+    }
+
+    [SysAbiExport(
+        Nid = "s1--uE9mBFw",
+        ExportName = "sceAudioOutClose",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAudioOut")]
+    public static int AudioOutClose(CpuContext ctx)
+    {
+        var handle = unchecked((int)ctx[CpuRegister.Rdi]);
+        return SetReturn(
+            ctx,
+            Ports.TryRemove(handle, out _)
+                ? 0
+                : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+    }
+
+    [SysAbiExport(
+        Nid = "QOQtbeDqsT4",
+        ExportName = "sceAudioOutOutput",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAudioOut")]
+    public static int AudioOutOutput(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "b+uAV89IlxE",
+        ExportName = "sceAudioOutSetVolume",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAudioOut")]
+    public static int AudioOutSetVolume(CpuContext ctx)
+    {
+        var handle = unchecked((int)ctx[CpuRegister.Rdi]);
+        return SetReturn(
+            ctx,
+            Ports.ContainsKey(handle)
+                ? 0
+                : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}

src/SharpEmu.Libs/AvPlayer/AvPlayerExports.cs

@@ -0,0 +1,77 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using SharpEmu.Libs.Kernel;
+
+namespace SharpEmu.Libs.AvPlayer;
+
+public static class AvPlayerExports
+{
+    private const int InvalidParameters = unchecked((int)0x806A0001);
+    private static readonly object StateGate = new();
+    private static readonly HashSet<ulong> Players = new();
+
+    [SysAbiExport(
+        Nid = "aS66RI0gGgo",
+        ExportName = "sceAvPlayerInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAvPlayer")]
+    public static int AvPlayerInit(CpuContext ctx)
+    {
+        if (ctx[CpuRegister.Rdi] == 0 ||
+            !KernelMemoryCompatExports.TryAllocateHleData(ctx, 0x40, 16, out var handle))
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return 0;
+        }
+
+        lock (StateGate)
+        {
+            Players.Add(handle);
+        }
+
+        ctx[CpuRegister.Rax] = handle;
+        return unchecked((int)handle);
+    }
+
+    [SysAbiExport(
+        Nid = "HD1YKVU26-M",
+        ExportName = "sceAvPlayerPostInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAvPlayer")]
+    public static int AvPlayerPostInit(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var dataAddress = ctx[CpuRegister.Rsi];
+        lock (StateGate)
+        {
+            return SetReturn(
+                ctx,
+                handle != 0 && dataAddress != 0 && Players.Contains(handle)
+                    ? 0
+                    : InvalidParameters);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "NkJwDzKmIlw",
+        ExportName = "sceAvPlayerClose",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAvPlayer")]
+    public static int AvPlayerClose(CpuContext ctx)
+    {
+        lock (StateGate)
+        {
+            return SetReturn(
+                ctx,
+                Players.Remove(ctx[CpuRegister.Rdi]) ? 0 : InvalidParameters);
+        }
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}

src/SharpEmu.Libs/CommonDialog/MsgDialogExports.cs

@@ -0,0 +1,27 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Threading;
+
+namespace SharpEmu.Libs.CommonDialog;
+
+public static class MsgDialogExports
+{
+    private const int AlreadyInitialized = unchecked((int)0x80B80002);
+    private static int _initialized;
+
+    [SysAbiExport(
+        Nid = "lDqxaY1UbEo",
+        ExportName = "sceMsgDialogInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceMsgDialog")]
+    public static int MsgDialogInitialize(CpuContext ctx)
+    {
+        var result = Interlocked.Exchange(ref _initialized, 1) == 0
+            ? 0
+            : AlreadyInitialized;
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}

src/SharpEmu.Libs/Kernel/KernelExceptionCompatExports.cs

@@ -0,0 +1,65 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Kernel;
+
+public static class KernelExceptionCompatExports
+{
+    private static readonly HashSet<int> AllowedSignals = new() { 1, 4, 8, 10, 11, 30 };
+    private static readonly Dictionary<int, ulong> _installedHandlers = new();
+    private static readonly object _gate = new();
+
+    [SysAbiExport(
+        Nid = "WkwEd3N7w0Y",
+        ExportName = "sceKernelInstallExceptionHandler",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int InstallExceptionHandler(CpuContext ctx)
+    {
+        var signum = unchecked((int)ctx[CpuRegister.Rdi]);
+        var handler = ctx[CpuRegister.Rsi];
+
+        if (!AllowedSignals.Contains(signum))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        lock (_gate)
+        {
+            if (_installedHandlers.ContainsKey(signum))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_ALREADY_EXISTS;
+            }
+
+            _installedHandlers[signum] = handler;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "Qhv5ARAoOEc",
+        ExportName = "sceKernelRemoveExceptionHandler",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int RemoveExceptionHandler(CpuContext ctx)
+    {
+        var signum = unchecked((int)ctx[CpuRegister.Rdi]);
+
+        if (!AllowedSignals.Contains(signum))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        lock (_gate)
+        {
+            _installedHandlers.Remove(signum);
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+}

src/SharpEmu.Libs/Kernel/KernelExports.cs

@@ -306,10 +306,6 @@ public static class KernelExports
     {
         var threadId = ctx[CpuRegister.Rdi];
         var returnValueAddress = ctx[CpuRegister.Rsi];
-        if (returnValueAddress != 0 && !ctx.TryWriteUInt64(returnValueAddress, 0))
-        {
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
-        }
 
         if (ShouldTracePthread())
         {
@@ -317,6 +313,30 @@ public static class KernelExports
                 $"[LOADER][TRACE] pthread_join: thread=0x{threadId:X16} retval_out=0x{returnValueAddress:X16}");
         }
 
+        var returnValue = 0UL;
+        if (GuestThreadExecution.Scheduler is { } scheduler &&
+            !scheduler.TryJoinThread(ctx, threadId, out returnValue, out var error))
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][ERROR] pthread_join: thread=0x{threadId:X16}: {error}");
+            var result = string.Equals(
+                error,
+                "thread cannot join itself",
+                StringComparison.Ordinal)
+                ? OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT
+                : OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            ctx[CpuRegister.Rax] = unchecked((ulong)(int)result);
+            return (int)result;
+        }
+
+        if (returnValueAddress != 0 &&
+            !ctx.TryWriteUInt64(returnValueAddress, returnValue))
+        {
+            ctx[CpuRegister.Rax] =
+                unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
         ctx[CpuRegister.Rax] = 0;
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
@@ -345,6 +365,13 @@ public static class KernelExports
         LibraryName = "libKernel")]
     public static int KernelOpen(CpuContext ctx) => KernelMemoryCompatExports.KernelOpenUnderscore(ctx);
 
+    [SysAbiExport(
+        Nid = "mqQMh1zPPT8",
+        ExportName = "fstat",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libc")]
+    public static int Fstat(CpuContext ctx) => KernelMemoryCompatExports.KernelFstat(ctx);
+
     [SysAbiExport(
         Nid = "hcuQgD53UxM",
         ExportName = "printf",

src/SharpEmu.Libs/Kernel/KernelMemoryCompatExports.cs

@@ -99,10 +99,13 @@ public static class KernelMemoryCompatExports
     private static readonly object _tlsGate = new();
     private static readonly object _ioTraceGate = new();
     private static readonly object _statCacheGate = new();
+    private static readonly object _guestMountGate = new();
     private static readonly Dictionary<ulong, DirectAllocation> _directAllocations = new();
     private static readonly Dictionary<ulong, LibcHeapAllocation> _libcAllocations = new();
     private static readonly Dictionary<ulong, MappedRegion> _mappedRegions = new();
+    private static readonly Dictionary<ulong, string> _mappedRegionNames = new();
     private static readonly Dictionary<ulong, ulong> _tlsModuleBlocks = new();
+    private static readonly Dictionary<string, string> _guestMounts = new(StringComparer.OrdinalIgnoreCase);
     private static readonly HashSet<string> _tracedStatResults = new(StringComparer.Ordinal);
     private static readonly HashSet<string> _negativeStatCache = new(StringComparer.OrdinalIgnoreCase);
     private static long _nextFileDescriptor = 2;
@@ -153,6 +156,32 @@ public static class KernelMemoryCompatExports
     private readonly record struct MappedRegion(ulong Address, ulong Length, int Protection, bool IsFlexible, bool IsDirect, ulong DirectStart);
     private readonly record struct BatchMapEntry(ulong Start, ulong Offset, ulong Length, byte Protection, byte Type, int Operation);
 
+    public static void RegisterGuestPathMount(string guestMountPoint, string hostRoot)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(guestMountPoint);
+        ArgumentException.ThrowIfNullOrWhiteSpace(hostRoot);
+
+        var normalizedMountPoint = NormalizeGuestStatCachePath(guestMountPoint);
+        if (normalizedMountPoint is null || normalizedMountPoint == "/")
+        {
+            throw new ArgumentException("Guest mount point must name a directory.", nameof(guestMountPoint));
+        }
+
+        var normalizedHostRoot = Path.GetFullPath(hostRoot);
+        Directory.CreateDirectory(normalizedHostRoot);
+        lock (_guestMountGate)
+        {
+            _guestMounts[normalizedMountPoint] = normalizedHostRoot;
+        }
+
+        lock (_statCacheGate)
+        {
+            _negativeStatCache.RemoveWhere(path =>
+                string.Equals(path, normalizedMountPoint, StringComparison.OrdinalIgnoreCase) ||
+                path.StartsWith(normalizedMountPoint + "/", StringComparison.OrdinalIgnoreCase));
+        }
+    }
+
     internal static bool TryAllocateHleData(
         CpuContext ctx,
         ulong length,
@@ -203,6 +232,25 @@ public static class KernelMemoryCompatExports
         return true;
     }
 
+    internal static void RegisterReservedVirtualRange(ulong address, ulong length)
+    {
+        if (address == 0 || length == 0)
+        {
+            return;
+        }
+
+        lock (_memoryGate)
+        {
+            _mappedRegions[address] = new MappedRegion(
+                address,
+                length,
+                Protection: 0,
+                IsFlexible: false,
+                IsDirect: false,
+                DirectStart: 0);
+        }
+    }
+
     [SysAbiExport(
         Nid = "8zTFvBIAIN8",
         ExportName = "memset",
@@ -2407,6 +2455,36 @@ public static class KernelMemoryCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+    Nid = "hwVSPCmp5tM",
+    ExportName = "sceKernelCheckedReleaseDirectMemory",
+    Target = Generation.Gen4 | Generation.Gen5,
+    LibraryName = "libKernel")]
+    public static int KernelCheckedReleaseDirectMemory(CpuContext ctx)
+    {
+        var start = ctx[CpuRegister.Rdi];
+        var length = ctx[CpuRegister.Rsi];
+
+        if (length == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        lock (_memoryGate)
+        {
+            if (!_directAllocations.TryGetValue(start, out var allocation) ||
+                allocation.Length != length)
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            }
+
+            _directAllocations.Remove(start);
+            _nextPhysicalAddress = GetDirectMemoryHighWaterMarkLocked();
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "L-Q3LEjIbgA",
         ExportName = "sceKernelMapDirectMemory",
@@ -2586,6 +2664,16 @@ public static class KernelMemoryCompatExports
         return KernelMapNamedFlexibleMemory(ctx);
     }
 
+    [SysAbiExport(
+        Nid = "4h6F1LLbTiw",
+        ExportName = "sceKernelMapFlexibleMemoryInternal",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelMapFlexibleMemoryInternal(CpuContext ctx)
+    {
+        return KernelMapNamedFlexibleMemory(ctx);
+    }
+
     [SysAbiExport(
         Nid = "2SKEx6bSq-4",
         ExportName = "sceKernelBatchMap",
@@ -2639,6 +2727,44 @@ public static class KernelMemoryCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "DGMG3JshrZU",
+        ExportName = "sceKernelSetVirtualRangeName",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelSetVirtualRangeName(CpuContext ctx)
+    {
+        var address = ctx[CpuRegister.Rdi];
+        var length = ctx[CpuRegister.Rsi];
+        var nameAddress = ctx[CpuRegister.Rdx];
+        if (nameAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (!TryReadCString(ctx, nameAddress, OrbisKernelMaximumNameLength, out var nameBytes))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var name = Encoding.UTF8.GetString(nameBytes);
+        lock (_memoryGate)
+        {
+            if (!TryFindVirtualQueryRegionLocked(address, findNext: false, out var region) ||
+                length > region.Length ||
+                address < region.Address ||
+                length > region.Address + region.Length - address)
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            }
+
+            _mappedRegionNames[region.Address] = name;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "rVjRvHJ0X6c",
         ExportName = "sceKernelVirtualQuery",
@@ -2696,11 +2822,16 @@ public static class KernelMemoryCompatExports
         BinaryPrimitives.WriteInt32LittleEndian(payload[28..32], memoryType);
         payload[32] = unchecked((byte)stateFlags);
 
-        var name = region.IsDirect
-            ? "direct"
-            : region.IsFlexible
-                ? "flexible"
-                : string.Empty;
+        string name;
+        lock (_memoryGate)
+        {
+            name = _mappedRegionNames.GetValueOrDefault(region.Address)
+                ?? (region.IsDirect
+                    ? "direct"
+                    : region.IsFlexible
+                        ? "flexible"
+                        : string.Empty);
+        }
         if (!string.IsNullOrEmpty(name))
         {
             var nameBytes = Encoding.ASCII.GetBytes(name);
@@ -4033,6 +4164,11 @@ public static class KernelMemoryCompatExports
             return guestPath;
         }
 
+        if (TryResolveRegisteredGuestMount(guestPath, out var mountedPath))
+        {
+            return mountedPath;
+        }
+
         if (guestPath.StartsWith("/devlog/app/", StringComparison.OrdinalIgnoreCase))
         {
             var relative = NormalizeMountRelativePath(guestPath["/devlog/app/".Length..]);
@@ -4131,6 +4267,51 @@ public static class KernelMemoryCompatExports
         return guestPath;
     }
 
+    private static bool TryResolveRegisteredGuestMount(string guestPath, out string hostPath)
+    {
+        hostPath = string.Empty;
+        var normalizedGuestPath = NormalizeGuestStatCachePath(guestPath);
+        if (normalizedGuestPath is null)
+        {
+            return false;
+        }
+
+        string? matchedMountPoint = null;
+        string? matchedHostRoot = null;
+        lock (_guestMountGate)
+        {
+            foreach (var (mountPoint, hostRoot) in _guestMounts)
+            {
+                if ((string.Equals(normalizedGuestPath, mountPoint, StringComparison.OrdinalIgnoreCase) ||
+                     normalizedGuestPath.StartsWith(mountPoint + "/", StringComparison.OrdinalIgnoreCase)) &&
+                    (matchedMountPoint is null || mountPoint.Length > matchedMountPoint.Length))
+                {
+                    matchedMountPoint = mountPoint;
+                    matchedHostRoot = hostRoot;
+                }
+            }
+        }
+
+        if (matchedMountPoint is null || matchedHostRoot is null)
+        {
+            return false;
+        }
+
+        var relativePath = normalizedGuestPath[matchedMountPoint.Length..].TrimStart('/');
+        var candidate = Path.GetFullPath(Path.Combine(
+            matchedHostRoot,
+            NormalizeMountRelativePath(relativePath)));
+        var rootWithSeparator = Path.TrimEndingDirectorySeparator(matchedHostRoot) + Path.DirectorySeparatorChar;
+        if (!string.Equals(candidate, matchedHostRoot, StringComparison.OrdinalIgnoreCase) &&
+            !candidate.StartsWith(rootWithSeparator, StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        hostPath = candidate;
+        return true;
+    }
+
     private static string? ResolveApp0Root()
     {
         var cached = Volatile.Read(ref _cachedApp0Root);

src/SharpEmu.Libs/Kernel/KernelPthreadCompatExports.cs

@@ -95,6 +95,13 @@ public static class KernelPthreadCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "7Xl257M4VNI",
+        ExportName = "pthread_equal",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libc")]
+    public static int PosixPthreadEqual(CpuContext ctx) => PthreadEqual(ctx);
+
     [SysAbiExport(
         Nid = "T72hz6ffq08",
         ExportName = "scePthreadYield",

src/SharpEmu.Libs/Kernel/KernelPthreadExtendedCompatExports.cs

@@ -717,6 +717,35 @@ public static class KernelPthreadExtendedCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "FXPWHNk8Of0",
+        ExportName = "scePthreadAttrGetschedparam",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadAttrGetschedparam(CpuContext ctx)
+    {
+        var attrAddress = ctx[CpuRegister.Rdi];
+        var schedParamAddress = ctx[CpuRegister.Rsi];
+        if (attrAddress == 0 || schedParamAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        PthreadAttrState state;
+        lock (_stateGate)
+        {
+            state = GetOrCreateAttrStateLocked(attrAddress);
+        }
+
+        if (!TryWriteInt32(ctx, schedParamAddress, state.SchedPriority))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "DzES9hQF4f4",
         ExportName = "scePthreadAttrSetschedparam",

src/SharpEmu.Libs/Kernel/KernelRuntimeCompatExports.cs

@@ -752,6 +752,7 @@ public static class KernelRuntimeCompatExports
             _nextReservedVirtualBase = Math.Max(_nextReservedVirtualBase, mappedAddress + length);
         }
 
+        KernelMemoryCompatExports.RegisterReservedVirtualRange(mappedAddress, length);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 

src/SharpEmu.Libs/Ngs2/Ngs2Exports.cs

@@ -0,0 +1,322 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using SharpEmu.Libs.Kernel;
+using System.Buffers.Binary;
+using System.Threading;
+
+namespace SharpEmu.Libs.Ngs2;
+
+public static class Ngs2Exports
+{
+    private const int OrbisNgs2ErrorInvalidOutAddress = unchecked((int)0x804A0053);
+    private const int OrbisNgs2ErrorInvalidSystemHandle = unchecked((int)0x804A0230);
+    private const int OrbisNgs2ErrorInvalidRackHandle = unchecked((int)0x804A0261);
+    private const int OrbisNgs2ErrorInvalidVoiceHandle = unchecked((int)0x804A0300);
+    private const ulong HandleStorageSize = 0x20;
+    private const int RenderBufferInfoSize = 0x18;
+    private const ulong MaximumRenderBufferSize = 16 * 1024 * 1024;
+
+    private static readonly object StateGate = new();
+    private static readonly Dictionary<ulong, SystemState> Systems = new();
+    private static readonly Dictionary<ulong, RackState> Racks = new();
+    private static readonly Dictionary<ulong, VoiceState> Voices = new();
+    private static long _nextUid;
+    private static long _renderCount;
+
+    private sealed record SystemState(uint Uid);
+    private sealed record RackState(ulong SystemHandle, uint RackId);
+    private sealed record VoiceState(ulong RackHandle, uint VoiceIndex);
+
+    [SysAbiExport(
+        Nid = "mPYgU4oYpuY",
+        ExportName = "sceNgs2SystemCreateWithAllocator",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2SystemCreateWithAllocator(CpuContext ctx)
+    {
+        var outHandleAddress = ctx[CpuRegister.Rdx];
+        if (outHandleAddress == 0)
+        {
+            return SetReturn(ctx, OrbisNgs2ErrorInvalidOutAddress);
+        }
+
+        if (!TryCreateHandle(ctx, type: 1, ownerHandle: 0, out var handle) ||
+            !ctx.TryWriteUInt64(outHandleAddress, handle))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        lock (StateGate)
+        {
+            Systems[handle] = new SystemState(unchecked((uint)Interlocked.Increment(ref _nextUid)));
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "u-WrYDaJA3k",
+        ExportName = "sceNgs2SystemDestroy",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2SystemDestroy(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        lock (StateGate)
+        {
+            if (!Systems.Remove(handle))
+            {
+                return SetReturn(ctx, OrbisNgs2ErrorInvalidSystemHandle);
+            }
+
+            var rackHandles = Racks
+                .Where(pair => pair.Value.SystemHandle == handle)
+                .Select(pair => pair.Key)
+                .ToArray();
+            foreach (var rackHandle in rackHandles)
+            {
+                RemoveRackLocked(rackHandle);
+            }
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "U546k6orxQo",
+        ExportName = "sceNgs2RackCreateWithAllocator",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2RackCreateWithAllocator(CpuContext ctx)
+    {
+        var systemHandle = ctx[CpuRegister.Rdi];
+        var rackId = unchecked((uint)ctx[CpuRegister.Rsi]);
+        var outHandleAddress = ctx[CpuRegister.R8];
+        lock (StateGate)
+        {
+            if (!Systems.ContainsKey(systemHandle))
+            {
+                return SetReturn(ctx, OrbisNgs2ErrorInvalidSystemHandle);
+            }
+        }
+
+        if (outHandleAddress == 0)
+        {
+            return SetReturn(ctx, OrbisNgs2ErrorInvalidOutAddress);
+        }
+
+        if (!TryCreateHandle(ctx, type: 2, systemHandle, out var handle) ||
+            !ctx.TryWriteUInt64(outHandleAddress, handle))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        lock (StateGate)
+        {
+            Racks[handle] = new RackState(systemHandle, rackId);
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "lCqD7oycmIM",
+        ExportName = "sceNgs2RackDestroy",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2RackDestroy(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        lock (StateGate)
+        {
+            if (!Racks.ContainsKey(handle))
+            {
+                return SetReturn(ctx, OrbisNgs2ErrorInvalidRackHandle);
+            }
+
+            RemoveRackLocked(handle);
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "MwmHz8pAdAo",
+        ExportName = "sceNgs2RackGetVoiceHandle",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2RackGetVoiceHandle(CpuContext ctx)
+    {
+        var rackHandle = ctx[CpuRegister.Rdi];
+        var voiceIndex = unchecked((uint)ctx[CpuRegister.Rsi]);
+        var outHandleAddress = ctx[CpuRegister.Rdx];
+        lock (StateGate)
+        {
+            if (!Racks.ContainsKey(rackHandle))
+            {
+                return SetReturn(ctx, OrbisNgs2ErrorInvalidRackHandle);
+            }
+
+            var existing = Voices.FirstOrDefault(
+                pair => pair.Value.RackHandle == rackHandle && pair.Value.VoiceIndex == voiceIndex);
+            if (existing.Key != 0)
+            {
+                return ctx.TryWriteUInt64(outHandleAddress, existing.Key)
+                    ? SetReturn(ctx, 0)
+                    : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+        }
+
+        if (outHandleAddress == 0)
+        {
+            return SetReturn(ctx, OrbisNgs2ErrorInvalidOutAddress);
+        }
+
+        if (!TryCreateHandle(ctx, type: 4, rackHandle, out var handle) ||
+            !ctx.TryWriteUInt64(outHandleAddress, handle))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        lock (StateGate)
+        {
+            Voices[handle] = new VoiceState(rackHandle, voiceIndex);
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "uu94irFOGpA",
+        ExportName = "sceNgs2VoiceControl",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2VoiceControl(CpuContext ctx)
+    {
+        lock (StateGate)
+        {
+            return SetReturn(
+                ctx,
+                Voices.ContainsKey(ctx[CpuRegister.Rdi]) ? 0 : OrbisNgs2ErrorInvalidVoiceHandle);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "AbYvTOZ8Pts",
+        ExportName = "sceNgs2VoiceRunCommands",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2VoiceRunCommands(CpuContext ctx) => Ngs2VoiceControl(ctx);
+
+    [SysAbiExport(
+        Nid = "i0VnXM-C9fc",
+        ExportName = "sceNgs2SystemRender",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2SystemRender(CpuContext ctx)
+    {
+        var systemHandle = ctx[CpuRegister.Rdi];
+        var bufferInfoAddress = ctx[CpuRegister.Rsi];
+        var bufferInfoCount = unchecked((uint)ctx[CpuRegister.Rdx]);
+        lock (StateGate)
+        {
+            if (!Systems.ContainsKey(systemHandle))
+            {
+                return SetReturn(ctx, OrbisNgs2ErrorInvalidSystemHandle);
+            }
+        }
+
+        if (bufferInfoCount != 0 && bufferInfoAddress == 0)
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        for (uint i = 0; i < bufferInfoCount; i++)
+        {
+            var entryAddress = bufferInfoAddress + (i * RenderBufferInfoSize);
+            if (!ctx.TryReadUInt64(entryAddress, out var bufferAddress) ||
+                !ctx.TryReadUInt64(entryAddress + 8, out var bufferSize))
+            {
+                return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            if (bufferAddress != 0 && bufferSize != 0)
+            {
+                if (bufferSize > MaximumRenderBufferSize || !TryClearGuestBuffer(ctx, bufferAddress, bufferSize))
+                {
+                    return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                }
+            }
+        }
+
+        var count = Interlocked.Increment(ref _renderCount);
+        if (ShouldTrace() && (count <= 4 || count % 10_000 == 0))
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][TRACE] ngs2.render#{count} system=0x{systemHandle:X16} buffers={bufferInfoCount}");
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    private static bool TryCreateHandle(CpuContext ctx, uint type, ulong ownerHandle, out ulong handle)
+    {
+        handle = 0;
+        if (!KernelMemoryCompatExports.TryAllocateHleData(ctx, HandleStorageSize, 16, out handle))
+        {
+            return false;
+        }
+
+        Span<byte> data = stackalloc byte[(int)HandleStorageSize];
+        data.Clear();
+        BinaryPrimitives.WriteUInt64LittleEndian(data[0..8], handle);
+        BinaryPrimitives.WriteUInt64LittleEndian(data[8..16], ownerHandle);
+        BinaryPrimitives.WriteUInt32LittleEndian(data[16..20], 1);
+        BinaryPrimitives.WriteUInt32LittleEndian(data[24..28], type);
+        return ctx.Memory.TryWrite(handle, data);
+    }
+
+    private static bool TryClearGuestBuffer(CpuContext ctx, ulong address, ulong length)
+    {
+        Span<byte> zeroes = stackalloc byte[4096];
+        zeroes.Clear();
+        for (ulong offset = 0; offset < length;)
+        {
+            var chunkSize = (int)Math.Min((ulong)zeroes.Length, length - offset);
+            if (!ctx.Memory.TryWrite(address + offset, zeroes[..chunkSize]))
+            {
+                return false;
+            }
+
+            offset += unchecked((uint)chunkSize);
+        }
+
+        return true;
+    }
+
+    private static void RemoveRackLocked(ulong rackHandle)
+    {
+        Racks.Remove(rackHandle);
+        foreach (var voiceHandle in Voices
+                     .Where(pair => pair.Value.RackHandle == rackHandle)
+                     .Select(pair => pair.Key)
+                     .ToArray())
+        {
+            Voices.Remove(voiceHandle);
+        }
+    }
+
+    private static bool ShouldTrace() =>
+        string.Equals(
+            Environment.GetEnvironmentVariable("SHARPEMU_LOG_NGS2"),
+            "1",
+            StringComparison.Ordinal);
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}

src/SharpEmu.Libs/Pad/PadExports.cs

@@ -4,6 +4,7 @@
 using SharpEmu.HLE;
 using System.Buffers.Binary;
 using System.Diagnostics;
+using System.Runtime.InteropServices;
 
 namespace SharpEmu.Libs.Pad;
 
@@ -58,6 +59,7 @@ public static class PadExports
             return SetReturn(ctx, OrbisPadErrorDeviceNotConnected);
         }
 
+        Console.Error.WriteLine("[LOADER][INFO] Keyboard controls: Arrow keys = D-pad, WASD = left stick, IJKL = right stick, Z/Enter = Cross, X/Esc = Circle, C = Square, V = Triangle, Q = L1, E = R1, R = L2, F = R2, Tab/Backspace = Options");
         return SetReturn(ctx, PrimaryPadHandle);
     }
 
@@ -158,14 +160,33 @@ public static class PadExports
             : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
     }
 
+    [SysAbiExport(
+    Nid = "W2G-yoyMF5U",
+    ExportName = "scePadSetVibrationMode",
+    Target = Generation.Gen4 | Generation.Gen5,
+    LibraryName = "libScePad")]
+    public static int PadSetVibrationMode(CpuContext ctx)
+    {
+        return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
     private static bool WriteNeutralPadData(CpuContext ctx, ulong dataAddress)
     {
         Span<byte> data = stackalloc byte[PadDataSize];
         data.Clear();
-        data[0x04] = 128;
-        data[0x05] = 128;
-        data[0x06] = 128;
-        data[0x07] = 128;
+        var acceptsKeyboardInput = IsEmulatorWindowFocused();
+        var buttons = acceptsKeyboardInput ? ReadKeyboardButtons() : 0;
+        BinaryPrimitives.WriteUInt32LittleEndian(data[0x00..], buttons);
+        var leftX = acceptsKeyboardInput ? ReadAnalogStick(IsKeyDown(0x41), IsKeyDown(0x44)) : (byte)128;
+        var leftY = acceptsKeyboardInput ? ReadAnalogStick(IsKeyDown(0x57), IsKeyDown(0x53)) : (byte)128;
+        var rightX = acceptsKeyboardInput ? ReadAnalogStick(IsKeyDown(0x4A), IsKeyDown(0x4C)) : (byte)128;
+        var rightY = acceptsKeyboardInput ? ReadAnalogStick(IsKeyDown(0x49), IsKeyDown(0x4B)) : (byte)128;
+        data[0x04] = leftX;
+        data[0x05] = leftY;
+        data[0x06] = rightX;
+        data[0x07] = rightY;
+        data[0x08] = acceptsKeyboardInput && IsKeyDown(0x52) ? (byte)255 : (byte)0;
+        data[0x09] = acceptsKeyboardInput && IsKeyDown(0x46) ? (byte)255 : (byte)0;
         BinaryPrimitives.WriteSingleLittleEndian(data[0x18..], 1.0f);
         data[0x4C] = 1;
         var timestampTicks = Stopwatch.GetTimestamp();
@@ -185,4 +206,58 @@ public static class PadExports
         ctx[CpuRegister.Rax] = unchecked((ulong)result);
         return result;
     }
+
+    [DllImport("user32.dll")]
+    private static extern short GetAsyncKeyState(int vKey);
+
+    [DllImport("user32.dll")]
+    private static extern nint GetForegroundWindow();
+
+    [DllImport("user32.dll")]
+    private static extern uint GetWindowThreadProcessId(nint hWnd, out uint processId);
+
+    private static bool IsKeyDown(int vk) =>
+        (GetAsyncKeyState(vk) & 0x8000) != 0;
+
+    private static bool IsEmulatorWindowFocused()
+    {
+        var foregroundWindow = GetForegroundWindow();
+        if (foregroundWindow == 0)
+        {
+            return false;
+        }
+
+        GetWindowThreadProcessId(foregroundWindow, out var processId);
+        return processId == (uint)Environment.ProcessId;
+    }
+
+    private static uint ReadKeyboardButtons()
+    {
+        uint buttons = 0;
+        // D-pad
+        if (IsKeyDown(0x25)) buttons |= 0x0080; // Left
+        if (IsKeyDown(0x27)) buttons |= 0x0020; // Right
+        if (IsKeyDown(0x26)) buttons |= 0x0010; // Up
+        if (IsKeyDown(0x28)) buttons |= 0x0040; // Down
+        // Face buttons
+        if (IsKeyDown(0x5A) || IsKeyDown(0x0D)) buttons |= 0x4000; // Z / Enter = Cross
+        if (IsKeyDown(0x58) || IsKeyDown(0x1B)) buttons |= 0x2000; // X / Escape = Circle
+        if (IsKeyDown(0x43)) buttons |= 0x8000; // C = Square
+        if (IsKeyDown(0x56)) buttons |= 0x1000; // V = Triangle
+        // Shoulder buttons
+        if (IsKeyDown(0x51)) buttons |= 0x0400; // Q = L1
+        if (IsKeyDown(0x45)) buttons |= 0x0800; // E = R1
+        if (IsKeyDown(0x52)) buttons |= 0x0100; // R = L2 (digital)
+        if (IsKeyDown(0x46)) buttons |= 0x0200; // F = R2 (digital)
+        // Options (Start)
+        if (IsKeyDown(0x09) || IsKeyDown(0x08)) buttons |= 0x0008; // Tab / Backspace = Options
+        return buttons;
+    }
+
+    private static byte ReadAnalogStick(bool negative, bool positive)
+    {
+        if (negative && !positive) return 0;
+        if (positive && !negative) return 255;
+        return 128;
+    }
 }

src/SharpEmu.Libs/SaveData/SaveDataExports.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
+using SharpEmu.Libs.Kernel;
 using System.Buffers.Binary;
 using System.Text;
 
@@ -10,6 +11,8 @@ namespace SharpEmu.Libs.SaveData;
 public static class SaveDataExports
 {
     private const int OrbisSaveDataErrorParameter = unchecked((int)0x809F0000);
+    private const int OrbisSaveDataErrorExists = unchecked((int)0x809F0007);
+    private const int OrbisSaveDataErrorNotFound = unchecked((int)0x809F0008);
     private const int OrbisSaveDataErrorInternal = unchecked((int)0x809F000B);
     private const int SaveDataTitleIdSize = 10;
     private const int SaveDataDirNameSize = 32;
@@ -23,6 +26,9 @@ public static class SaveDataExports
     private const ulong ResultInfosOffset = 0x20;
     private const uint SortKeyFreeBlocks = 5;
     private const uint SortOrderDescent = 1;
+    private const uint MountModeCreate = 1u << 2;
+    private const uint MountModeCreate2 = 1u << 5;
+    private const int MountResultSize = 0x40;
     private static readonly object _stateGate = new();
     private static string? _titleId;
 
@@ -149,6 +155,125 @@ public static class SaveDataExports
         }
     }
 
+    [SysAbiExport(
+        Nid = "ZP4e7rlzOUk",
+        ExportName = "sceSaveDataMount3",
+        Target = Generation.Gen5,
+        LibraryName = "libSceSaveData")]
+    public static int SaveDataMount3(CpuContext ctx)
+    {
+        var mountAddress = ctx[CpuRegister.Rdi];
+        var resultAddress = ctx[CpuRegister.Rsi];
+        if (mountAddress == 0 || resultAddress == 0)
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorParameter);
+        }
+
+        if (!TryReadInt32(ctx, mountAddress, out var userId) ||
+            !ctx.TryReadUInt64(mountAddress + 0x08, out var dirNameAddress) ||
+            !ctx.TryReadUInt64(mountAddress + 0x10, out var blocks) ||
+            !ctx.TryReadUInt64(mountAddress + 0x18, out var systemBlocks) ||
+            !TryReadUInt32(ctx, mountAddress + 0x20, out var mountMode) ||
+            !TryReadUInt32(ctx, mountAddress + 0x24, out var resource) ||
+            !TryReadUInt32(ctx, mountAddress + 0x28, out var mode) ||
+            dirNameAddress == 0 ||
+            !TryReadFixedAscii(ctx, dirNameAddress, SaveDataDirNameSize, out var dirName))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        if (userId < 0 || string.IsNullOrWhiteSpace(dirName))
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorParameter);
+        }
+
+        try
+        {
+            var titleId = ResolveConfiguredTitleId();
+            var savePath = Path.Combine(
+                ResolveTitleSaveRoot(userId, titleId),
+                SanitizePathSegment(dirName));
+            var existed = Directory.Exists(savePath);
+            var create = (mountMode & MountModeCreate) != 0;
+            var createIfMissing = (mountMode & MountModeCreate2) != 0;
+
+            if (!existed && !create && !createIfMissing)
+            {
+                return SetReturn(ctx, OrbisSaveDataErrorNotFound);
+            }
+
+            if (existed && create)
+            {
+                return SetReturn(ctx, OrbisSaveDataErrorExists);
+            }
+
+            if (!existed)
+            {
+                Directory.CreateDirectory(savePath);
+            }
+
+            const string mountPoint = "/savedata0";
+            KernelMemoryCompatExports.RegisterGuestPathMount(mountPoint, savePath);
+
+            Span<byte> result = stackalloc byte[MountResultSize];
+            result.Clear();
+            WriteAscii(result[..16], mountPoint);
+            BinaryPrimitives.WriteUInt32LittleEndian(result[0x1C..], createIfMissing && !existed ? 1u : 0u);
+            if (!ctx.Memory.TryWrite(resultAddress, result))
+            {
+                return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            TraceSaveData(
+                $"mount3 user={userId} title={titleId} dir={dirName} blocks={blocks} " +
+                $"system_blocks={systemBlocks} mount_mode=0x{mountMode:X} resource={resource} mode={mode} " +
+                $"mount_point={mountPoint} created={!existed} root='{savePath}'");
+            return SetReturn(ctx, 0);
+        }
+        catch (IOException)
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorInternal);
+        }
+        catch (UnauthorizedAccessException)
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorInternal);
+        }
+        catch (ArgumentException)
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorParameter);
+        }
+    }
+
+    private static int _nextTransactionResource;
+    [SysAbiExport(
+        Nid = "gjRZNnw0JPE",
+        ExportName = "sceSaveDataCreateTransactionResource",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceSaveData")]
+    public static int SaveDataCreateTransactionResource(CpuContext ctx)
+    {
+        var userId = unchecked((int)ctx[CpuRegister.Rdi]);
+        var reserved = ctx[CpuRegister.Rsi];
+        var resourceAddress = ctx[CpuRegister.Rdx];
+
+        if (resourceAddress == 0)
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorParameter);
+        }
+
+        var id = (uint)Interlocked.Increment(ref _nextTransactionResource);
+
+        if (!TryWriteUInt32(ctx, resourceAddress, id))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceSaveData(
+            $"create_transaction_resource user={userId} reserved=0x{reserved:X} resource_addr=0x{resourceAddress:X} id={id}");
+
+        return SetReturn(ctx, 0);
+    }
+
     private static bool TryReadSearchCond(CpuContext ctx, ulong address, out SearchCond cond)
     {
         cond = default;
@@ -305,7 +430,7 @@ public static class SaveDataExports
     {
         var configured = Environment.GetEnvironmentVariable("SHARPEMU_SAVEDATA_DIR");
         var root = string.IsNullOrWhiteSpace(configured)
-            ? Path.Combine(Environment.CurrentDirectory, "user", "savedata")
+            ? Path.Combine(AppContext.BaseDirectory, "user", "savedata")
             : configured;
         return Path.GetFullPath(root);
     }

src/SharpEmu.Libs/SharpEmu.Libs.csproj

@@ -10,6 +10,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
 
   <ItemGroup>
     <PackageReference Include="Silk.NET.Vulkan" />
+    <PackageReference Include="Silk.NET.Vulkan.Extensions.EXT" />
     <PackageReference Include="Silk.NET.Vulkan.Extensions.KHR" />
     <PackageReference Include="Silk.NET.Windowing" />
   </ItemGroup>

src/SharpEmu.Libs/VideoOut/VideoOutExports.cs

@@ -4,6 +4,7 @@
 using SharpEmu.HLE;
 using SharpEmu.Libs.Kernel;
 using System.Buffers.Binary;
+using System.Diagnostics;
 using System.Diagnostics.CodeAnalysis;
 using System.Threading;
 
@@ -48,6 +49,13 @@ public static class VideoOutExports
     private static int _frameDumpCount;
     private static long _nextFrameDumpIndex;
     private static string _windowTitle = "SharpEmu VideoOut";
+    private static readonly bool _logFrameRate = string.Equals(
+        Environment.GetEnvironmentVariable("SHARPEMU_LOG_VIDEOOUT_FPS"),
+        "1",
+        StringComparison.Ordinal);
+    private static long _frameRateWindowStart = Stopwatch.GetTimestamp();
+    private static long _submittedFrameCount;
+    private static long _presentedFrameCount;
 
     public static void ConfigureApplicationInfo(string? title, string? titleId, string? version)
     {
@@ -812,9 +820,46 @@ public static class VideoOutExports
         }
 
         TraceVideoOut($"videoout.submit_flip handle={handle} index={bufferIndex} mode={flipMode} arg={flipArg} events={flipEvents.Count}");
+        ReportFrameRate(presented: false);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    internal static void ReportPresentedFrame() =>
+        ReportFrameRate(presented: true);
+
+    private static void ReportFrameRate(bool presented)
+    {
+        if (!_logFrameRate)
+        {
+            return;
+        }
+
+        if (presented)
+        {
+            Interlocked.Increment(ref _presentedFrameCount);
+        }
+        else
+        {
+            Interlocked.Increment(ref _submittedFrameCount);
+        }
+
+        var started = Volatile.Read(ref _frameRateWindowStart);
+        var now = Stopwatch.GetTimestamp();
+        var elapsedTicks = now - started;
+        if (elapsedTicks < Stopwatch.Frequency ||
+            Interlocked.CompareExchange(ref _frameRateWindowStart, now, started) != started)
+        {
+            return;
+        }
+
+        var elapsedSeconds = (double)elapsedTicks / Stopwatch.Frequency;
+        var submitted = Interlocked.Exchange(ref _submittedFrameCount, 0);
+        var presentedCount = Interlocked.Exchange(ref _presentedFrameCount, 0);
+        Console.Error.WriteLine(
+            $"[LOADER][PERF] videoout submitted_fps={submitted / elapsedSeconds:F1} " +
+            $"presented_fps={presentedCount / elapsedSeconds:F1}");
+    }
+
     private static int RegisterBufferRange(VideoOutPortState port, int startIndex, ReadOnlySpan<ulong> addresses, BufferAttribute attribute, int requestedGroupIndex = -1)
     {
         lock (_stateGate)

src/SharpEmu.Libs/packages.lock.json

@@ -11,6 +11,16 @@
           "Silk.NET.Core": "2.23.0"
         }
       },
+      "Silk.NET.Vulkan.Extensions.EXT": {
+        "type": "Direct",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "+Oth189ksRiL6HvGCwIdnsYHawqrbO8y49u1H61z3wsfcHhQZeVDYe/wF5LD7fk3NcdgDvwFD3mLm1QWhdZySw==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
       "Silk.NET.Vulkan.Extensions.KHR": {
         "type": "Direct",
         "requested": "[2.23.0, )",