refactor: from guest threads to EE scheduler

ps2xIOP/include/ps2x/iop/iop_types.h

@@ -94,6 +94,9 @@ namespace ps2x::iop
         bool signalCompletion = false;
         CallbackPolicy callbackPolicy = CallbackPolicy::RuntimeDefault;
         ServerDispatchPolicy serverDispatchPolicy = ServerDispatchPolicy::RuntimeDefault;
+        uint32_t guestFunction = 0;
+        uint32_t guestArguments[4]{};
+        uint32_t guestDefaultResultAddress = 0;
     };
 
     enum class SifTransferKind : uint32_t

ps2xIOP/src/modules/cri_dtx.cpp

@@ -133,48 +133,26 @@ namespace ps2x::iop::detail
                 const bool hasUrpcHandler = isUrpc && command < 64u && urpcFunction != 0u;
                 if (hasUrpcHandler && request.serverFunction != 0u)
                 {
-                    uint32_t serverResult = 0u;
-                    if (m_host.invokeGuestFunction(request.callToken,
-                                                   request.serverFunction,
-                                                   request.function,
-                                                   request.serverBuffer,
-                                                   request.send.size,
-                                                   0u,
-                                                   &serverResult))
-                    {
-                        result.handled = true;
-                        result.resultAddress = serverResult;
-                        if (result.resultAddress == 0u && request.serverBuffer != 0u)
-                        {
-                            result.resultAddress = request.serverBuffer;
-                        }
-                        if (result.resultAddress == 0u && request.receive.address != 0u)
-                        {
-                            result.resultAddress = request.receive.address;
-                        }
-                        return result;
-                    }
+                    result.guestFunction = request.serverFunction;
+                    result.guestArguments[0] = request.function;
+                    result.guestArguments[1] = request.serverBuffer;
+                    result.guestArguments[2] = request.send.size;
+                    result.guestDefaultResultAddress = request.serverBuffer != 0u
+                                                           ? request.serverBuffer
+                                                           : request.receive.address;
+                    return result;
                 }
 
                 if (hasUrpcHandler &&
                     request.send.address != 0u &&
                     request.send.size > 0u)
                 {
-                    uint32_t dispatcherResult = 0u;
-                    if (m_host.invokeGuestFunction(request.callToken,
-                                                   m_bindings.dispatcherFunctionAddress,
-                                                   request.function,
-                                                   request.send.address,
-                                                   request.send.size,
-                                                   0u,
-                                                   &dispatcherResult))
-                    {
-                        result.handled = true;
-                        result.resultAddress = dispatcherResult != 0u
-                                                   ? dispatcherResult
-                                                   : request.send.address;
-                        return result;
-                    }
+                    result.guestFunction = m_bindings.dispatcherFunctionAddress;
+                    result.guestArguments[0] = request.function;
+                    result.guestArguments[1] = request.send.address;
+                    result.guestArguments[2] = request.send.size;
+                    result.guestDefaultResultAddress = request.send.address;
+                    return result;
                 }
 
                 if (request.function == 2u &&

ps2xRecomp/src/lib/control_flow_emitter.cpp

@@ -177,7 +177,7 @@ namespace ps2recomp
         m_ss << fmt::format("{}ctx->pc = 0x{:X}u;\n", indent, target);
         if (target <= sourcePc && !isCallLikeEdge())
         {
-            m_ss << fmt::format("{}if (runtime->shouldPreemptGuestExecution()) {{\n", indent);
+            m_ss << fmt::format("{}if (runtime->eeCheckpointDue()) {{\n", indent);
             m_ss << fmt::format("{}    return;\n", indent);
             m_ss << fmt::format("{}}}\n", indent);
         }
@@ -296,10 +296,16 @@ namespace ps2recomp
         const std::string_view handlerName = isSyscall ? resolvedSyscallName : resolvedStubName;
 
         m_ss << indent << "{\n";
-        m_ss << indent << "    const uint32_t __entryPc = ctx->pc;\n";
+        if (kind == StaticBranchKind::Call)
+        {
+            m_ss << fmt::format("{}    ctx->pc = 0x{:X}u;\n", indent, fallthroughPc());
+        }
+        else
+        {
+            m_ss << indent << "    ctx->pc = getRegU32(ctx, 31);\n";
+        }
         m_ss << indent << "    " << (isSyscall ? "ps2_syscalls::" : "ps2_stubs::")
              << handlerName << "(rdram, ctx, runtime);\n";
-        m_ss << indent << "    if (ctx->pc == __entryPc) { ctx->pc = getRegU32(ctx, 31); }\n";
         m_ss << indent << "}\n";
 
         if (kind == StaticBranchKind::Jump)

ps2xRecomp/src/lib/function_emitter.cpp

@@ -226,7 +226,7 @@ namespace ps2recomp
             }
         }
 
-        // Fallthrough with no terminating branch: advance ctx->pc past the function so dispatchLoop doesn't re-call it forever.
+        // Fallthrough with no terminating branch: publish the next PC so the EE dispatcher does not re-enter this function.
         if (!instructions.empty() && !lastInstructionWasControlFlow)
         {
             ss << "    ctx->pc = 0x" << std::hex << function.end << "u;\n"

ps2xRecomp/src/lib/ps2_recompiler.cpp

@@ -1078,7 +1078,7 @@ namespace ps2recomp
                     stub << "#ifdef _DEBUG\n";
                     stub << "    PS_LOG_ENTRY(\"" << generatedName << "\");\n";
                     stub << "#endif\n";
-                    stub << "    const uint32_t __entryPc = ctx->pc;\n"
+                    stub << "    ctx->pc = getRegU32(ctx, 31);\n"
                          << "    ";
 
                     if (function.isSkipped)
@@ -1115,12 +1115,7 @@ namespace ps2recomp
                         }
                     }
 
-                    stub << "\n"
-                         << "    if (ctx->pc == __entryPc)\n"
-                         << "    {\n"
-                         << "        ctx->pc = getRegU32(ctx, 31);\n"
-                         << "    }\n"
-                         << "}";
+                    stub << "\n}";
                     m_generatedStubs[function.start] = stub.str();
                 }
             }

ps2xRecomp/src/lib/special_translator.cpp

@@ -41,7 +41,9 @@ namespace ps2recomp
         case SPECIAL_JALR:
             return fmt::format("// JALR ${}, ${} - Handled by branch logic", inst.rd, inst.rs);
         case SPECIAL_SYSCALL:
-            return fmt::format("runtime->handleSyscall(rdram, ctx, 0x{:X}u);", (inst.raw >> 6) & 0xFFFFFu);
+            return fmt::format("ctx->pc = 0x{:X}u;\nruntime->handleSyscall(rdram, ctx, 0x{:X}u);",
+                               inst.address + 4u,
+                               (inst.raw >> 6) & 0xFFFFFu);
         case SPECIAL_BREAK:
             return fmt::format("runtime->handleBreak(rdram, ctx);");
         case SPECIAL_SYNC:

ps2xRuntime/include/ps2_runtime.h

@@ -17,11 +17,10 @@
 #include <atomic>
 #include <array>
 #include <mutex>
-#include <condition_variable>
 #include <filesystem>
-#include <iostream>
-#include <iomanip>
 #include <memory>
+#include <unordered_map>
+#include <unordered_set>
 
 #include "ps2_log.h"
 #include "runtime/ps2_address.h"
@@ -40,6 +39,8 @@ namespace ps2x::iop
 
 class PS2IopHostAdapter;
 class PS2IopTransport;
+class EeScheduler;
+struct EeEvent;
 
 enum PS2Exception
 {
@@ -248,7 +249,6 @@ inline void ps2TraceGuestWrite(uint8_t *rdram,
     (void)valueHi;
     (void)op;
     (void)ctx;
-    // TODO we dont need this anymore so on next release it will be deleted
 }
 
 inline void ps2TraceGuestRangeWrite(uint8_t *rdram,
@@ -262,7 +262,6 @@ inline void ps2TraceGuestRangeWrite(uint8_t *rdram,
     (void)size;
     (void)op;
     (void)ctx;
-    // TODO we dont need this anymore so on next release it will be deleted
 }
 
 class PS2Runtime
@@ -321,46 +320,6 @@ public:
         SkipCallDebug = 3,
     };
 
-    class GuestExecutionScope
-    {
-    public:
-        explicit GuestExecutionScope(PS2Runtime *runtime) noexcept;
-        ~GuestExecutionScope();
-
-        GuestExecutionScope(const GuestExecutionScope &) = delete;
-        GuestExecutionScope &operator=(const GuestExecutionScope &) = delete;
-
-    private:
-        PS2Runtime *m_runtime = nullptr;
-    };
-
-    class GuestExecutionReleaseScope
-    {
-    public:
-        explicit GuestExecutionReleaseScope(PS2Runtime *runtime) noexcept;
-        ~GuestExecutionReleaseScope();
-
-        GuestExecutionReleaseScope(const GuestExecutionReleaseScope &) = delete;
-        GuestExecutionReleaseScope &operator=(const GuestExecutionReleaseScope &) = delete;
-
-    private:
-        PS2Runtime *m_runtime = nullptr;
-        uint32_t m_depth = 0u;
-    };
-
-    class DeferredGuestYieldScope
-    {
-    public:
-        explicit DeferredGuestYieldScope(bool &pendingOut) noexcept;
-        ~DeferredGuestYieldScope();
-
-        DeferredGuestYieldScope(const DeferredGuestYieldScope &) = delete;
-        DeferredGuestYieldScope &operator=(const DeferredGuestYieldScope &) = delete;
-
-    private:
-        bool &m_pendingOut;
-    };
-
     bool replaceFunction(uint32_t address, RecompiledFunction func);
     // TODO remove this later need to update all tests
     bool registerFunction(uint32_t address, RecompiledFunction func);
@@ -413,31 +372,27 @@ public:
     uint32_t guestHeapLimit() const;
     uint32_t reserveAsyncCallbackStack(uint32_t size, uint32_t alignment = 16u);
 
-    void dispatchLoop(uint8_t *rdram, R5900Context *ctx);
-
     void drainCompletedDmacHandlers(uint8_t *rdram);
 
-    bool shouldPreemptGuestExecution();
-    void yieldGuestExecutionAfterWake();
-    void waitForGuestExecutionHandoff();
-    void waitForGuestExecutionHandoff(uint64_t baselineEpoch);
-    uint64_t guestExecutionHandoffEpochSnapshot() const
-    {
-        return m_guestExecutionHandoffEpoch.load(std::memory_order_acquire);
-    }
-
     void requestStop();
     bool isStopRequested() const;
 
-    uint32_t guestExecutionWaiterCountForTesting() const
-    {
-        return m_guestExecutionWaiters.load(std::memory_order_acquire);
-    }
+    EeScheduler &eeScheduler();
+    const EeScheduler &eeScheduler() const;
+    void postEeEvent(EeEvent event);
+    bool eeCheckpointDue() const noexcept;
 
-    uint64_t guestExecutionHandoffTimeouts() const
+    struct EeExitHandlerRegistration
     {
-        return m_guestExecutionHandoffTimeouts.load(std::memory_order_relaxed);
-    }
+        uint32_t function = 0;
+        uint32_t argument = 0;
+    };
+    void addEeExitHandler(int threadId, uint32_t function, uint32_t argument);
+    std::vector<EeExitHandlerRegistration> takeEeExitHandlers(int threadId);
+    void removeEeExitHandlers(int threadId);
+    bool findEeSyscallOverride(uint32_t syscallNumber, uint32_t &handler) const;
+    void setEeSyscallOverride(uint8_t *rdram, uint32_t syscallNumber, uint32_t handler);
+    void initializeEeKernelState(uint8_t *rdram);
 
     uint8_t Load8(uint8_t *rdram, R5900Context *ctx, uint32_t vaddr);
     uint16_t Load16(uint8_t *rdram, R5900Context *ctx, uint32_t vaddr);
@@ -502,12 +457,6 @@ private:
     uint32_t allocateGuestBlockLocked(uint32_t size, uint32_t alignment);
     void freeGuestBlockLocked(uint32_t guestAddr);
     void coalesceGuestHeapLocked();
-    void enterGuestExecution();
-    void leaveGuestExecution();
-    uint32_t releaseGuestExecution();
-    void reacquireGuestExecution(uint32_t depth);
-    void markGuestExecutionAcquired();
-
     void HandleIntegerOverflow(R5900Context *ctx);
 
     [[nodiscard]] ps2x::iop::RpcAbi selectIopRpcAbi(const ps2x::iop::RpcAbiRequest &request) const;
@@ -515,9 +464,8 @@ private:
     void notifyIopSifTransfer(uint8_t *rdram, const ps2x::iop::SifTransfer &transfer);
     void resetIop();
 
-    friend class GuestExecutionScope;
-    friend class GuestExecutionReleaseScope;
     friend class PS2IopTransport;
+    friend class EeScheduler;
 
 private:
     PS2Memory m_memory;
@@ -530,12 +478,11 @@ private:
     VU1Interpreter m_vu0;
     VU1Interpreter m_vu1;
     R5900Context m_cpuContext;
-    mutable std::recursive_mutex m_guestExecutionMutex;
-    mutable std::atomic<uint32_t> m_guestExecutionWaiters{0u};
-    mutable std::mutex m_guestExecutionHandoffMutex;
-    mutable std::condition_variable m_guestExecutionHandoffCv;
-    std::atomic<uint64_t> m_guestExecutionHandoffEpoch{0u};
-    std::atomic<uint64_t> m_guestExecutionHandoffTimeouts{0u};
+    std::unique_ptr<EeScheduler> m_eeScheduler;
+    mutable std::mutex m_eeKernelStateMutex;
+    std::unordered_map<int, std::vector<EeExitHandlerRegistration>> m_eeExitHandlers;
+    std::unordered_map<uint32_t, uint32_t> m_eeSyscallOverrides;
+    std::unordered_set<uint32_t> m_eeSyscallMirrorAddresses;
     mutable std::mutex m_guestHeapMutex;
     mutable std::mutex m_asyncCallbackStackMutex;
     std::vector<GuestHeapBlock> m_guestHeapBlocks;

ps2xRuntime/include/ps2_syscalls.h

@@ -11,8 +11,6 @@
 
 std::string translatePs2Path(const char *ps2Path);
 
-extern std::atomic<int> g_activeThreads;
-
 inline std::mutex g_sys_fd_mutex;
 
 namespace ps2_syscalls
@@ -29,15 +27,10 @@ namespace ps2_syscalls
 
     bool dispatchNumericSyscall(uint32_t syscallNumber, uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);
     void dispatchDmacHandlersForCause(uint8_t *rdram, PS2Runtime *runtime, uint32_t cause);
-    void initializeGuestKernelState(uint8_t *rdram);
+    void initializeGuestKernelState(uint8_t *rdram, PS2Runtime *runtime);
     void TODO(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime, uint32_t encodedSyscallId);
-    void notifyRuntimeStop();
-    void joinAllGuestHostThreads();
-    void detachAllGuestHostThreads();
-    void EnsureVSyncWorkerRunning(uint8_t *rdram, PS2Runtime *runtime);
-    uint64_t GetCurrentVSyncTick();
-    uint64_t WaitForNextVSyncTick(uint8_t *rdram, PS2Runtime *runtime);
-    void WaitVSyncTick(uint8_t *rdram, PS2Runtime *runtime);
+    uint64_t GetCurrentVSyncTick(PS2Runtime *runtime);
+    void WaitVSyncTick(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime, int fixedResult = -1);
 }
 
 #endif // PS2_SYSCALLS_H

ps2xRuntime/include/runtime/ee_scheduler.h

@@ -0,0 +1,435 @@
+#pragma once
+
+#include "ps2_runtime.h"
+
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <deque>
+#include <functional>
+#include <mutex>
+#include <optional>
+#include <thread>
+#include <unordered_map>
+#include <variant>
+#include <vector>
+
+// This exception is the EE equivalent of a longjmp to the dispatcher.  It is
+// not an error and must only be caught at EeScheduler::run().
+struct EeDispatcherTransfer final
+{
+};
+
+enum class EeThreadStatus : uint8_t
+{
+    Running,
+    Ready,
+    Waiting,
+    WaitingSuspended,
+    Suspended,
+    Dormant,
+};
+
+enum class EeWaitReason : uint8_t
+{
+    None,
+    Sleep,
+    Semaphore,
+    EventFlag,
+    VSync,
+    External,
+    Mpeg,
+};
+
+struct EeSemaphoreWait
+{
+    int id = 0;
+};
+
+struct EeEventFlagWait
+{
+    int id = 0;
+    uint32_t bits = 0;
+    uint32_t mode = 0;
+    uint32_t resultAddress = 0;
+};
+
+struct EeVSyncWait
+{
+    uint64_t afterTick = 0;
+    int fixedResult = -1;
+};
+
+struct EeExternalWait
+{
+    uint32_t type = 0;
+    uint64_t token = 0;
+};
+
+using EeWaitPayload = std::variant<std::monostate,
+                                   EeSemaphoreWait,
+                                   EeEventFlagWait,
+                                   EeVSyncWait,
+                                   EeExternalWait>;
+
+struct EeWaitState
+{
+    EeWaitReason reason = EeWaitReason::None;
+    EeWaitPayload payload{};
+    std::function<void(R5900Context &)> completion;
+};
+
+enum class GuestInvocationKind : uint8_t
+{
+    Interrupt,
+    Alarm,
+    GsCallback,
+    RpcCallback,
+    SyscallOverride,
+    ExitHandler,
+    HleCall,
+};
+
+struct GuestInvocation
+{
+    GuestInvocationKind kind = GuestInvocationKind::Interrupt;
+    uint64_t sequence = 0;
+    uint64_t tag = 0;
+    R5900Context context{};
+    std::function<void(const R5900Context &, R5900Context &)> onComplete;
+};
+
+struct GuestThread
+{
+    int id = 0;
+    R5900Context context{};
+    uint32_t entry = 0;
+    uint32_t stack = 0;
+    uint32_t stackSize = 0;
+    uint32_t gp = 0;
+    uint32_t attr = 0;
+    uint32_t option = 0;
+    uint32_t arg = 0;
+    int initialPriority = 0;
+    int currentPriority = 0;
+    EeThreadStatus status = EeThreadStatus::Dormant;
+    int suspendCount = 0;
+    uint32_t wakeupCount = 0;
+    bool ownsStack = false;
+    uint32_t tlsBase = 0;
+    EeWaitState wait{};
+    std::function<void(R5900Context &)> resumeCompletion;
+    std::vector<GuestInvocation> invocations;
+
+    [[nodiscard]] R5900Context &activeContext()
+    {
+        return invocations.empty() ? context : invocations.back().context;
+    }
+
+    [[nodiscard]] const R5900Context &activeContext() const
+    {
+        return invocations.empty() ? context : invocations.back().context;
+    }
+};
+
+struct EeSemaphore
+{
+    int id = 0;
+    int count = 0;
+    int maxCount = 0;
+    int initCount = 0;
+    uint32_t attr = 0;
+    uint32_t option = 0;
+    std::deque<int> waiters;
+};
+
+struct EeEventFlag
+{
+    int id = 0;
+    uint32_t attr = 0;
+    uint32_t option = 0;
+    uint32_t initBits = 0;
+    uint32_t bits = 0;
+    std::deque<int> waiters;
+};
+
+struct EeAlarm
+{
+    int id = 0;
+    uint16_t ticks = 0;
+    uint32_t handler = 0;
+    uint32_t argument = 0;
+    uint32_t gp = 0;
+    uint32_t sp = 0;
+};
+
+struct EeIrqHandler
+{
+    int id = 0;
+    uint32_t cause = 0;
+    uint32_t handler = 0;
+    uint32_t argument = 0;
+    uint32_t gp = 0;
+    uint32_t sp = 0;
+    bool enabled = true;
+    int order = 0;
+};
+
+struct EeThreadSnapshot
+{
+    int id = 0;
+    uint32_t pc = 0;
+    uint32_t entry = 0;
+    uint32_t stack = 0;
+    uint32_t stackSize = 0;
+    uint32_t gp = 0;
+    int initialPriority = 0;
+    int currentPriority = 0;
+    EeThreadStatus status = EeThreadStatus::Dormant;
+    EeWaitReason waitReason = EeWaitReason::None;
+    int waitId = 0;
+    int suspendCount = 0;
+    uint32_t wakeupCount = 0;
+};
+
+struct EeSemaphoreSnapshot
+{
+    int id = 0;
+    int count = 0;
+    int maxCount = 0;
+    uint32_t waiters = 0;
+};
+
+struct EeEventFlagSnapshot
+{
+    int id = 0;
+    uint32_t bits = 0;
+    uint32_t initBits = 0;
+    uint32_t attr = 0;
+    uint32_t waiters = 0;
+};
+
+struct EeKernelSnapshot
+{
+    uint64_t sequence = 0;
+    int runningThreadId = 0;
+    std::vector<EeThreadSnapshot> threads;
+    std::vector<EeSemaphoreSnapshot> semaphores;
+    std::vector<EeEventFlagSnapshot> eventFlags;
+};
+
+enum class EeEventType : uint8_t
+{
+    Stop,
+    VBlankStart,
+    VBlankEnd,
+    Dmac,
+    ExternalWake,
+    Alarm,
+};
+
+struct EeEvent
+{
+    EeEventType type = EeEventType::ExternalWake;
+    uint32_t id = 0;
+    uint64_t value = 0;
+};
+
+struct EeThreadCreateParams
+{
+    uint32_t attr = 0;
+    uint32_t entry = 0;
+    uint32_t stack = 0;
+    uint32_t stackSize = 0;
+    uint32_t gp = 0;
+    int priority = 0;
+    uint32_t option = 0;
+};
+
+class EeScheduler
+{
+public:
+    static constexpr int kMainThreadId = 1;
+    static constexpr int kFirstThreadId = 2;
+    static constexpr int kLastThreadId = 255;
+    static constexpr int kPriorityCount = 128;
+
+    explicit EeScheduler(PS2Runtime &runtime);
+    ~EeScheduler();
+
+    EeScheduler(const EeScheduler &) = delete;
+    EeScheduler &operator=(const EeScheduler &) = delete;
+
+    void reset(uint8_t *rdram, const R5900Context &mainContext);
+    void run();
+    void requestStop();
+    void postEvent(EeEvent event);
+    [[nodiscard]] bool checkpointDue() const noexcept;
+    [[nodiscard]] bool isExecutingGuest() const noexcept;
+
+    // Kernel object API. All calls except postEvent/requestStop execute on the
+    // EE executor and therefore need no host synchronization.
+    int createThread(const EeThreadCreateParams &params);
+    int deleteThread(int id, uint32_t &ownedStack);
+    int startThread(int id, uint32_t arg, const R5900Context &caller, bool interruptSafe);
+    [[noreturn]] void exitCurrent(bool deleteThread);
+    int terminateThread(int id, uint32_t &ownedStack, bool interruptSafe);
+    int suspendThread(int id, bool interruptSafe);
+    int resumeThread(int id, bool interruptSafe);
+    void sleepCurrent();
+    int wakeupThread(int id, bool interruptSafe);
+    int cancelWakeup(int id);
+    int changePriority(int id, int priority, bool interruptSafe, int &oldPriority);
+    int rotateReadyQueue(int priority, bool interruptSafe);
+    int releaseWait(int id, bool interruptSafe);
+    void transferIfRequested(bool interruptSafe);
+
+    int createSemaphore(int initCount, int maxCount, uint32_t attr, uint32_t option);
+    int deleteSemaphore(int id, bool interruptSafe);
+    int signalSemaphore(int id, bool interruptSafe);
+    int pollSemaphore(int id);
+    void waitSemaphore(int id);
+
+    int createEventFlag(uint32_t initialBits, uint32_t attr, uint32_t option);
+    int deleteEventFlag(int id, bool interruptSafe);
+    int setEventFlag(int id, uint32_t bits, bool interruptSafe);
+    int clearEventFlag(int id, uint32_t mask);
+    int pollEventFlag(int id, uint32_t bits, uint32_t mode, uint32_t &observedBits);
+    void waitEventFlag(int id, uint32_t bits, uint32_t mode, uint32_t resultAddress);
+
+    int setAlarm(uint16_t ticks, uint32_t handler, uint32_t argument, uint32_t gp, uint32_t sp);
+    int cancelAlarm(int id);
+    void queueInvocation(GuestInvocation invocation);
+    [[noreturn]] void invokeCurrent(GuestInvocation invocation);
+    [[noreturn]] void invokeCurrentSequence(std::vector<GuestInvocation> invocations);
+    [[nodiscard]] bool hasInvocation(GuestInvocationKind kind, uint64_t tag) const;
+    [[nodiscard]] uint32_t invocationStackTop();
+
+    int addIrqHandler(bool dmac,
+                      uint32_t cause,
+                      uint32_t handler,
+                      bool append,
+                      uint32_t argument,
+                      uint32_t gp,
+                      uint32_t sp);
+    int removeIrqHandler(bool dmac, uint32_t cause, int id);
+    int setIrqHandlerEnabled(bool dmac, int id, bool enabled);
+    int setIrqCauseEnabled(bool dmac, uint32_t cause, bool enabled);
+    void dispatchIrq(bool dmac, uint32_t cause);
+    void setVSyncFlag(uint32_t flagAddress, uint32_t tickAddress);
+    [[nodiscard]] uint64_t currentVSyncTick() const noexcept;
+    uint32_t setGsVSyncCallback(uint32_t callback, uint32_t gp, uint32_t sp);
+
+    [[noreturn]] void waitVSync(uint64_t afterTick, int fixedResult = -1);
+    void completeVSync(uint64_t tick);
+    void completeExternalWait(uint32_t type, uint64_t token, int result);
+    [[noreturn]] void waitExternal(EeWaitReason reason,
+                                   uint32_t type,
+                                   uint64_t token,
+                                   std::function<void(R5900Context &)> completion = {});
+
+    [[nodiscard]] GuestThread *thread(int id);
+    [[nodiscard]] const GuestThread *thread(int id) const;
+    [[nodiscard]] EeSemaphore *semaphore(int id);
+    [[nodiscard]] const EeSemaphore *semaphore(int id) const;
+    [[nodiscard]] EeEventFlag *eventFlag(int id);
+    [[nodiscard]] const EeEventFlag *eventFlag(int id) const;
+    [[nodiscard]] GuestThread *currentThread();
+    [[nodiscard]] const GuestThread *currentThread() const;
+    [[nodiscard]] int currentThreadId() const noexcept;
+    [[nodiscard]] R5900Context *currentContext();
+    [[nodiscard]] uint8_t *rdram() const noexcept;
+
+    // Direct syscall tests use the same main-thread record without starting a
+    // second executor. Production execution calls reset() before run().
+    void bindMainContextForSyscall(R5900Context &ctx, uint8_t *rdram);
+
+    [[nodiscard]] EeKernelSnapshot snapshot() const;
+    void publishSnapshot();
+
+private:
+    struct ScheduledEvent
+    {
+        std::chrono::steady_clock::time_point deadline{};
+        EeEvent event{};
+        uint64_t sequence = 0;
+    };
+
+    void assertExecutor() const;
+    [[nodiscard]] int allocateThreadId();
+    GuestThread &acquireInvocationThread();
+    void enqueueReady(GuestThread &thread, bool front = false);
+    void removeReady(GuestThread &thread);
+    [[nodiscard]] GuestThread *selectReady();
+    void makeRunning(GuestThread &thread);
+    void makeDormant(GuestThread &thread);
+    void removeFromWaitObject(GuestThread &thread);
+    [[noreturn]] void blockCurrent(EeWaitState wait);
+    void makeReady(GuestThread &thread, int result, bool interruptSafe);
+    void requestPreemptionIfHigher(const GuestThread &readyThread, bool interruptSafe);
+    void applyPendingPreemption();
+    void processPendingEvents();
+    void processDueDeadlines();
+    void processEvent(const EeEvent &event);
+    void finishEventWaiters(EeEventFlag &flag, bool interruptSafe);
+    [[nodiscard]] static bool eventCondition(uint32_t current, uint32_t requested, uint32_t mode);
+    static int waitObjectId(const EeWaitState &wait);
+    void writeGuestU32(uint32_t address, uint32_t value);
+    void waitForEvent();
+    void scheduleEvent(std::chrono::steady_clock::time_point deadline, EeEvent event);
+    void updateNextDeadline();
+    void copyMainContextToRuntime();
+
+    PS2Runtime &m_runtime;
+    uint8_t *m_rdram = nullptr;
+    std::array<std::deque<int>, kPriorityCount> m_readyQueues{};
+    std::unordered_map<int, GuestThread> m_threads;
+    std::unordered_map<int, EeSemaphore> m_semaphores;
+    std::unordered_map<int, EeEventFlag> m_eventFlags;
+    std::unordered_map<int, EeAlarm> m_alarms;
+    std::unordered_map<int, EeIrqHandler> m_intcHandlers;
+    std::unordered_map<int, EeIrqHandler> m_dmacHandlers;
+    int m_nextThreadId = kFirstThreadId;
+    int m_nextInvocationThreadId = -1;
+    int m_nextSemaphoreId = 1;
+    int m_nextEventFlagId = 1;
+    int m_nextAlarmId = 1;
+    int m_nextIntcHandlerId = 1;
+    int m_nextDmacHandlerId = 1;
+    int m_intcHeadOrder = 0;
+    int m_intcTailOrder = 1000;
+    int m_dmacHeadOrder = 0;
+    int m_dmacTailOrder = 1000;
+    uint32_t m_enabledIntcMask = 0xFFFFFFFFu;
+    uint32_t m_enabledDmacMask = 0xFFFFFFFFu;
+    int m_currentThreadId = 0;
+    bool m_rescheduleRequested = false;
+    bool m_insideInterrupt = false;
+    std::thread::id m_executorThread{};
+    std::atomic<bool> m_running{false};
+    std::atomic<bool> m_guestExecuting{false};
+    std::atomic<bool> m_stopRequested{false};
+    std::atomic<bool> m_checkpointPending{false};
+
+    mutable std::mutex m_eventMutex;
+    std::condition_variable m_eventCv;
+    std::deque<EeEvent> m_events;
+    std::vector<ScheduledEvent> m_deadlines;
+    std::deque<GuestInvocation> m_pendingInvocations;
+    uint64_t m_eventSequence = 0;
+    uint64_t m_invocationSequence = 0;
+    uint64_t m_vsyncTick = 0;
+    uint32_t m_vsyncFlagAddress = 0;
+    uint32_t m_vsyncTickAddress = 0;
+    uint32_t m_gsVSyncCallback = 0;
+    uint32_t m_gsVSyncCallbackGp = 0;
+    uint32_t m_gsVSyncCallbackSp = 0;
+    std::unordered_map<uint64_t, uint32_t> m_invocationStackTops;
+    std::atomic<int64_t> m_nextDeadlineNanoseconds{0};
+
+    mutable std::mutex m_snapshotMutex;
+    EeKernelSnapshot m_snapshot;
+    uint64_t m_snapshotSequence = 0;
+};

ps2xRuntime/include/runtime/ps2_memory.h

@@ -204,20 +204,16 @@ struct GSRegisters
     uint64_t extdata;  // External data
     uint64_t extwrite; // External write
     uint64_t bgcolor;  // Background color
-    // Status. Concurrency contract: the vsync worker thread toggles the FIELD bit
-    // (bit 13) once per tick; guest threads issue write-one-to-clear writes against
-    // the SIGNAL/FINISH status bits (0..1) via the MMIO path; the GIF sets SIGNAL
-    // and FINISH from yet another thread. All three interleave, so this register
-    // must be updated with atomic RMWs only (no load-then-store pairs anywhere).
+    // Status remains atomic because the renderer/UI can observe it while the
+    // single EE executor updates SIGNAL, FINISH and FIELD.
     std::atomic<uint64_t> csr;
+    std::atomic<uint64_t> vsyncTick;
     uint64_t imr;      // Interrupt mask
     uint64_t busdir;   // Bus direction
     uint64_t siglblid; // Signal label ID
 };
-static_assert(sizeof(GSRegisters) == (19u * sizeof(uint64_t)), "GSRegisters layout changed unexpectedly");
+static_assert(sizeof(GSRegisters) == (20u * sizeof(uint64_t)), "GSRegisters layout changed unexpectedly");
 static_assert(alignof(GSRegisters) == alignof(uint64_t), "GSRegisters alignment must remain 64-bit");
-// CSR is written by the vsync worker while guest threads concurrently read/write it
-// (MMIO) and the GIF sets SIGNAL/FINISH; a lock-free atomic keeps that path wait-free.
 static_assert(std::atomic<uint64_t>::is_always_lock_free, "GS CSR atomic must be lock-free on all supported targets");
 
 // PS2 VIF (VPU Interface) registers

ps2xRuntime/src/lib/Kernel/Stubs/CD.cpp

@@ -573,7 +573,7 @@ namespace ps2_stubs
             }
             if (hitStreamEnd || g_cdStreamingLbn == g_cdStreamingEndLbn)
             {
-                notifyMpegCdStreamEof();
+                notifyMpegCdStreamEof(runtime);
             }
         }
         else
@@ -582,7 +582,7 @@ namespace ps2_stubs
             {
                 std::memset(rdram + offset, 0, requestedBytes);
             }
-            notifyMpegCdStreamEof();
+            notifyMpegCdStreamEof(runtime);
         }
 
         if (int32_t *err = reinterpret_cast<int32_t *>(getMemPtr(rdram, errAddr)); err)
@@ -635,7 +635,7 @@ namespace ps2_stubs
         g_cdStreamingEndLbn = cdStreamingEndLbnForStart(g_cdStreamingLbn);
         g_cdStReadTraceCount = 0u;
 
-        notifyMpegCdStreamStart();
+        notifyMpegCdStreamStart(runtime);
 
         std::cerr << "[sceCdStStart] lbn=0x" << std::hex << g_cdStreamingLbn
                   << " endLbn=0x" << g_cdStreamingEndLbn << std::dec << std::endl;
@@ -649,7 +649,7 @@ namespace ps2_stubs
 
     void sceCdStStop(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        notifyMpegCdStreamEof();
+        notifyMpegCdStreamEof(runtime);
         setReturnS32(ctx, 1);
     }
 

ps2xRuntime/src/lib/Kernel/Stubs/GS.cpp

@@ -3,20 +3,12 @@
 #include "ps2_log.h"
 #include "runtime/ps2_gs_common.h"
 #include "runtime/ps2_gs_psmct16.h"
+#include "runtime/ee_scheduler.h"
 
 namespace ps2_stubs
 {
     namespace
     {
-        std::mutex g_gs_sync_v_mutex;
-        uint64_t g_gs_sync_v_base_tick = 0u;
-        std::mutex g_gs_sync_v_callback_mutex;
-        uint32_t g_gs_sync_v_callback_func = 0u;
-        uint32_t g_gs_sync_v_callback_gp = 0u;
-        uint32_t g_gs_sync_v_callback_sp = 0u;
-        uint32_t g_gs_sync_v_callback_stack_base = 0u;
-        uint32_t g_gs_sync_v_callback_stack_top = 0u;
-        uint32_t g_gs_sync_v_callback_bad_pc_logs = 0u;
         uint64_t makeClearPrim(bool useContext2)
         {
             return static_cast<uint64_t>(GS_PRIM_SPRITE) |
@@ -598,175 +590,6 @@ namespace ps2_stubs
         setReturnU32(ctx, terminatePacketBuilderState(rdram, ctx, runtime));
     }
 
-    static void resetGsSyncVState()
-    {
-        std::lock_guard<std::mutex> lock(g_gs_sync_v_mutex);
-        g_gs_sync_v_base_tick = ps2_syscalls::GetCurrentVSyncTick();
-    }
-
-    static int32_t getGsSyncVFieldForTick(uint64_t tick)
-    {
-        std::lock_guard<std::mutex> lock(g_gs_sync_v_mutex);
-        if (tick <= g_gs_sync_v_base_tick)
-        {
-            return 0;
-        }
-
-        return static_cast<int32_t>((tick - g_gs_sync_v_base_tick - 1u) & 1u);
-    }
-
-    void resetGsSyncVCallbackState()
-    {
-        {
-            std::lock_guard<std::mutex> lock(g_gs_sync_v_callback_mutex);
-            g_gs_sync_v_callback_func = 0u;
-            g_gs_sync_v_callback_gp = 0u;
-            g_gs_sync_v_callback_sp = 0u;
-            g_gs_sync_v_callback_stack_base = 0u;
-            g_gs_sync_v_callback_stack_top = 0u;
-            g_gs_sync_v_callback_bad_pc_logs = 0u;
-        }
-        resetGsSyncVState();
-    }
-
-    void dispatchGsSyncVCallback(uint8_t *rdram, PS2Runtime *runtime, uint64_t tick)
-    {
-        if (!rdram || !runtime)
-        {
-            return;
-        }
-
-        uint32_t callback = 0u;
-        uint32_t gp = 0u;
-        uint32_t callbackStackTop = 0u;
-        const uint64_t callbackTick = (tick != 0u) ? tick : ps2_syscalls::GetCurrentVSyncTick();
-        {
-            std::lock_guard<std::mutex> lock(g_gs_sync_v_callback_mutex);
-            callback = g_gs_sync_v_callback_func;
-            gp = g_gs_sync_v_callback_gp;
-            callbackStackTop = g_gs_sync_v_callback_stack_top;
-            if (callback == 0u)
-            {
-                return;
-            }
-        }
-
-        if (!runtime->hasFunction(callback))
-        {
-            static uint32_t s_missingCallbackLogCount = 0u;
-            if (s_missingCallbackLogCount < 32u)
-            {
-                PS2_IF_AGRESSIVE_LOGS({
-                    std::cerr << "[sceGsSyncVCallback:missing] cb=0x" << std::hex << callback
-                              << " gp=0x" << gp
-                              << " tick=0x" << callbackTick
-                              << std::dec << std::endl;
-                });
-                ++s_missingCallbackLogCount;
-            }
-            return;
-        }
-
-        if (callbackStackTop == 0u)
-        {
-            constexpr uint32_t kCallbackStackSize = 0x4000u;
-            const uint32_t stackTop = runtime->reserveAsyncCallbackStack(kCallbackStackSize, 16u);
-            if (stackTop != 0u)
-            {
-                std::lock_guard<std::mutex> lock(g_gs_sync_v_callback_mutex);
-                if (g_gs_sync_v_callback_stack_top == 0u)
-                {
-                    g_gs_sync_v_callback_stack_base = stackTop - (kCallbackStackSize - 0x10u);
-                    g_gs_sync_v_callback_stack_top = stackTop;
-                }
-                callbackStackTop = g_gs_sync_v_callback_stack_top;
-            }
-        }
-
-        try
-        {
-            R5900Context callbackCtx{};
-            SET_GPR_U32(&callbackCtx, 28, gp);
-            SET_GPR_U32(&callbackCtx, 29, (callbackStackTop != 0u) ? callbackStackTop : (PS2_RAM_SIZE - 0x10u));
-            SET_GPR_U32(&callbackCtx, 31, 0u);
-            SET_GPR_U32(&callbackCtx, 4, static_cast<uint32_t>(callbackTick));
-            callbackCtx.pc = callback;
-
-            static uint32_t s_dispatchLogCount = 0u;
-            const bool shouldLogDispatch = (s_dispatchLogCount < 64u);
-            if (shouldLogDispatch)
-            {
-                PS2_IF_AGRESSIVE_LOGS({
-                    RUNTIME_LOG("[sceGsSyncVCallback:dispatch] cb=0x" << std::hex << callback
-                                                                      << " gp=0x" << gp
-                                                                      << " sp=0x" << getRegU32(&callbackCtx, 29)
-                                                                      << " tick=0x" << callbackTick
-                                                                      << std::dec << std::endl);
-                });
-            }
-
-            uint32_t steps = 0u;
-            bool reschedulePending = false;
-            uint64_t handoffBaseline = 0u;
-            {
-                PS2Runtime::GuestExecutionScope guestExecution(runtime);
-                PS2Runtime::DeferredGuestYieldScope deferYield(reschedulePending);
-
-                while (callbackCtx.pc != 0u && !runtime->isStopRequested() && steps < 1024u)
-                {
-                    if (!runtime->hasFunction(callbackCtx.pc))
-                    {
-                        if (g_gs_sync_v_callback_bad_pc_logs < 16u)
-                        {
-                            std::cerr << "[sceGsSyncVCallback:bad-pc] pc=0x" << std::hex << callbackCtx.pc
-                                      << " ra=0x" << getRegU32(&callbackCtx, 31)
-                                      << " sp=0x" << getRegU32(&callbackCtx, 29)
-                                      << " gp=0x" << getRegU32(&callbackCtx, 28)
-                                      << std::dec << std::endl;
-                            ++g_gs_sync_v_callback_bad_pc_logs;
-                        }
-                        callbackCtx.pc = 0u;
-                        break;
-                    }
-
-                    auto step = runtime->lookupFunction(callbackCtx.pc);
-                    if (!step)
-                    {
-                        break;
-                    }
-                    ++steps;
-                    step(rdram, &callbackCtx, runtime);
-                }
-                handoffBaseline = runtime->guestExecutionHandoffEpochSnapshot();
-            }
-            if (reschedulePending && !runtime->isStopRequested())
-            {
-                runtime->waitForGuestExecutionHandoff(handoffBaseline);
-            }
-
-            if (shouldLogDispatch)
-            {
-                PS2_IF_AGRESSIVE_LOGS({
-                    RUNTIME_LOG("[sceGsSyncVCallback:return] cb=0x" << std::hex << callback
-                                                                    << " finalPc=0x" << callbackCtx.pc
-                                                                    << " ra=0x" << getRegU32(&callbackCtx, 31)
-                                                                    << " steps=0x" << steps
-                                                                    << std::dec << std::endl);
-                });
-                ++s_dispatchLogCount;
-            }
-        }
-        catch (const std::exception &e)
-        {
-            static uint32_t warnCount = 0u;
-            if (warnCount < 8u)
-            {
-                std::cerr << "[sceGsSyncVCallback] callback exception: " << e.what() << std::endl;
-                ++warnCount;
-            }
-        }
-    }
-
     void sceGsExecLoadImage(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         uint32_t imgAddr = getRegU32(ctx, 4);
@@ -979,8 +802,6 @@ namespace ps2_stubs
             g_gparam.omode = static_cast<uint8_t>(omode & 0xFF);
             g_gparam.ffmode = static_cast<uint8_t>(ffmode & 0x1);
             writeGsGParamToScratch(runtime);
-            resetGsSyncVState();
-
             uint64_t pmode = makePmode(1, 0, 0, 0, 0, 0x80);
             uint64_t smode2 = (interlace & 0x1) | ((ffmode & 0x1) << 1);
             uint64_t dispfb = makeDispFb(0, 10, 0, 0, 0);
@@ -1459,14 +1280,10 @@ namespace ps2_stubs
 
     void sceGsSyncV(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        const uint64_t tick = ps2_syscalls::WaitForNextVSyncTick(rdram, runtime);
-        if (g_gparam.interlace != 0u)
-        {
-            setReturnS32(ctx, getGsSyncVFieldForTick(tick));
-            return;
-        }
-
-        setReturnS32(ctx, 1);
+        ps2_syscalls::WaitVSyncTick(rdram,
+                                    ctx,
+                                    runtime,
+                                    g_gparam.interlace != 0u ? -1 : 1);
     }
 
     void sceGsSyncVCallback(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
@@ -1477,17 +1294,9 @@ namespace ps2_stubs
         const uint32_t gp = getRegU32(ctx, 28);
         const uint32_t sp = getRegU32(ctx, 29);
 
-        uint32_t oldCallback = 0u;
-        {
-            std::lock_guard<std::mutex> lock(g_gs_sync_v_callback_mutex);
-            oldCallback = g_gs_sync_v_callback_func;
-            g_gs_sync_v_callback_func = newCallback;
-            if (newCallback != 0u)
-            {
-                g_gs_sync_v_callback_gp = gp;
-                g_gs_sync_v_callback_sp = sp;
-            }
-        }
+        EeScheduler &ee = runtime->eeScheduler();
+        ee.bindMainContextForSyscall(*ctx, rdram);
+        const uint32_t oldCallback = ee.setGsVSyncCallback(newCallback, gp, sp);
 
         static uint32_t s_syncVCallbackLogCount = 0u;
         if (s_syncVCallbackLogCount < 128u)
@@ -1504,11 +1313,6 @@ namespace ps2_stubs
             ++s_syncVCallbackLogCount;
         }
 
-        if (newCallback != 0u)
-        {
-            ps2_syscalls::EnsureVSyncWorkerRunning(rdram, runtime);
-        }
-
         setReturnU32(ctx, oldCallback);
     }
 

ps2xRuntime/src/lib/Kernel/Stubs/GS.h

@@ -4,8 +4,6 @@
 
 namespace ps2_stubs
 {
-    void resetGsSyncVCallbackState();
-    void dispatchGsSyncVCallback(uint8_t *rdram, PS2Runtime *runtime, uint64_t tick);
     void sceGifPkAddGsAD(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);
     void sceGifPkAddGsData(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);
     void sceGifPkCloseGifTag(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);

ps2xRuntime/src/lib/Kernel/Stubs/IPU.cpp

@@ -1,47 +1,19 @@
 #include "Common.h"
 #include "IPU.h"
+#include "runtime/ee_scheduler.h"
 
-namespace ps2_stubs
+namespace
 {
-    void sceIpuInit(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
+    constexpr uint32_t REG_IPU_CTRL = 0x10002010u;
+    constexpr uint32_t REG_IPU_CMD = 0x10002000u;
+    constexpr uint32_t REG_IPU_IN_FIFO = 0x10007010u;
+    constexpr uint32_t IQVAL_BASE = 0x1721e0u;
+    constexpr uint32_t VQVAL_BASE = 0x172230u;
+    constexpr uint32_t SETD4_CHCR_ENTRY = 0x126428u;
+
+    void completeIpuInit(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        static constexpr uint32_t REG_IPU_CTRL = 0x10002010u;
-        static constexpr uint32_t REG_IPU_CMD = 0x10002000u;
-        static constexpr uint32_t REG_IPU_IN_FIFO = 0x10007010u;
-        static constexpr uint32_t IQVAL_BASE = 0x1721e0u;
-        static constexpr uint32_t VQVAL_BASE = 0x172230u;
-        static constexpr uint32_t SETD4_CHCR_ENTRY = 0x126428u;
-
-        if (!runtime)
-            return;
-
-        if (!runtime->memory().getRDRAM())
-        {
-            if (!runtime->memory().initialize())
-            {
-                setReturnS32(ctx, -1);
-                return;
-            }
-        }
-
-        if (!runtime->syncCoreSubsystems())
-        {
-            setReturnS32(ctx, -1);
-            return;
-        }
-
         PS2Memory &mem = runtime->memory();
-
-        if (runtime->hasFunction(SETD4_CHCR_ENTRY))
-        {
-            auto setD4 = runtime->lookupFunction(SETD4_CHCR_ENTRY);
-            ctx->r[4] = _mm_set_epi64x(0, 1);
-            {
-                PS2Runtime::GuestExecutionScope guestExecution(runtime);
-                setD4(rdram, ctx, runtime);
-            }
-        }
-
         mem.write32(REG_IPU_CTRL, 0x40000000u);
         mem.write32(REG_IPU_CMD, 0u);
 
@@ -70,12 +42,54 @@ namespace ps2_stubs
 
         mem.write32(REG_IPU_CMD, 0x60000000u);
         mem.write32(REG_IPU_CMD, 0x90000000u);
-
         mem.write32(REG_IPU_CTRL, 0x40000000u);
         mem.write32(REG_IPU_CMD, 0u);
-
         setReturnS32(ctx, 0);
     }
+}
+
+namespace ps2_stubs
+{
+    void sceIpuInit(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        if (!runtime)
+            return;
+
+        if (!runtime->memory().getRDRAM())
+        {
+            if (!runtime->memory().initialize())
+            {
+                setReturnS32(ctx, -1);
+                return;
+            }
+        }
+
+        if (!runtime->syncCoreSubsystems())
+        {
+            setReturnS32(ctx, -1);
+            return;
+        }
+
+        if (runtime->hasFunction(SETD4_CHCR_ENTRY))
+        {
+            EeScheduler &scheduler = runtime->eeScheduler();
+            scheduler.bindMainContextForSyscall(*ctx, rdram);
+            GuestInvocation invocation{};
+            invocation.kind = GuestInvocationKind::HleCall;
+            invocation.context = *ctx;
+            invocation.context.pc = SETD4_CHCR_ENTRY;
+            SET_GPR_U32(&invocation.context, 4, 1u);
+            SET_GPR_U32(&invocation.context, 29, 0u);
+            SET_GPR_U32(&invocation.context, 31, 0u);
+            invocation.onComplete = [rdram, runtime](const R5900Context &, R5900Context &parent)
+            {
+                completeIpuInit(rdram, &parent, runtime);
+            };
+            scheduler.invokeCurrent(std::move(invocation));
+        }
+
+        completeIpuInit(rdram, ctx, runtime);
+    }
 
     void sceIpuRestartDMA(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {

ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp

@@ -1,5 +1,6 @@
 #include "Common.h"
 #include "MPEG.h"
+#include "runtime/ee_scheduler.h"
 
 #if !defined(PS2X_HAS_FFMPEG)
 #define PS2X_HAS_FFMPEG 1
@@ -15,8 +16,6 @@ extern "C"
 }
 #endif
 
-#include <chrono>
-#include <condition_variable>
 #include <deque>
 #include <memory>
 
@@ -472,16 +471,11 @@ namespace ps2_stubs
             bool streamEnded = false;
             bool decoderFailed = false;
             uint64_t cdStreamGeneration = 0u;
-            bool noFrameStallArmed = false;
-            std::chrono::steady_clock::time_point noFrameStallStart{};
-            uint32_t consecutiveEmptyGetPicture = 0u;
             bool waitingForVideoSequenceHeader = true;
             std::vector<uint8_t> videoSequenceSyncBuffer;
             std::vector<uint8_t> pssBuffer;
             std::vector<uint32_t> pssGuestAddrs;
             std::deque<MpegDecodedFrame> decodedFrames;
-            bool hasLastFrame = false;
-            MpegDecodedFrame lastFrame;
             std::unique_ptr<MpegFfmpegDecoder> decoder;
         };
 
@@ -513,7 +507,7 @@ namespace ps2_stubs
         };
 
         std::mutex g_mpeg_stub_mutex;
-        std::condition_variable g_mpeg_cv;
+        constexpr uint32_t kMpegPictureWaitType = 1u;
         MpegStubState g_mpeg_stub_state;
 
         // TODO this resolution should follow runtime resolution
@@ -529,10 +523,6 @@ namespace ps2_stubs
         constexpr uint8_t kMpegPrivateStream1 = 0xBDu;
         constexpr size_t kStartCodeNotFound = std::numeric_limits<size_t>::max();
         constexpr uint32_t kMpegCallbackDataSize = 0x20u;
-        constexpr uint32_t kMpegCallbackMaxSteps = 0x4000u;
-        constexpr std::chrono::milliseconds kMpegGetPictureNoFrameWaitTimeout{64};
-        constexpr std::chrono::milliseconds kMpegNoFrameEndTimeout{500};
-        constexpr uint32_t kMpegMaxConsecutiveEmptyGetPicture = 60u;
 
         uint32_t align16(uint32_t value)
         {
@@ -732,77 +722,6 @@ namespace ps2_stubs
             }
         }
 
-        void clearNoFrameStall(MpegPlaybackState &playback)
-        {
-            playback.noFrameStallArmed = false;
-            playback.noFrameStallStart = {};
-        }
-
-        void finishPlaybackStream(uint32_t mpegAddr, MpegPlaybackState &playback);
-
-        bool maybeFinishNoFrameStall(uint32_t mpegAddr, MpegPlaybackState &playback)
-        {
-            if (playback.streamEnded || playback.decoderFailed || !playback.decodedFrames.empty())
-            {
-                clearNoFrameStall(playback);
-                playback.consecutiveEmptyGetPicture = 0u;
-                return false;
-            }
-
-            if (!playback.sawInput || playback.picturesServed == 0u)
-            {
-                return false;
-            }
-
-            const auto now = std::chrono::steady_clock::now();
-            const bool cdStreamEofSeen = g_mpeg_stub_state.currentCdStreamEofSeen;
-
-            bool stallByNoFrame = false;
-            if (cdStreamEofSeen)
-            {
-                if (!playback.noFrameStallArmed)
-                {
-                    playback.noFrameStallArmed = true;
-                    playback.noFrameStallStart = now;
-                }
-                else if (now - playback.noFrameStallStart >= kMpegNoFrameEndTimeout)
-                {
-                    stallByNoFrame = true;
-                }
-            }
-            else
-            {
-                clearNoFrameStall(playback);
-            }
-
-            const bool stallByConsecutive =
-                cdStreamEofSeen && (playback.consecutiveEmptyGetPicture >= kMpegMaxConsecutiveEmptyGetPicture);
-
-            if (!stallByNoFrame && !stallByConsecutive)
-            {
-                return false;
-            }
-
-            finishPlaybackStream(mpegAddr, playback);
-
-            static uint32_t s_noFrameEofLogCount = 0u;
-            if (s_noFrameEofLogCount < 16u)
-            {
-                PS2_IF_AGRESSIVE_LOGS({
-                    std::cerr << "[MPEG:no-frame-eof] mpeg=0x" << std::hex << mpegAddr
-                              << std::dec << " served=" << playback.picturesServed
-                              << " sawInput=" << playback.sawInput
-                              << " cdEof=" << cdStreamEofSeen
-                              << " reason="
-                              << (stallByNoFrame ? "no-frame" : "consecutive")
-                              << " consecutiveEmpty=" << playback.consecutiveEmptyGetPicture
-                              << std::endl;
-                });
-                ++s_noFrameEofLogCount;
-            }
-            return true;
-        }
-
         void feedElementaryStream(MpegPlaybackState &playback, const uint8_t *data, size_t size)
         {
             if (!data || size == 0)
@@ -890,10 +809,6 @@ namespace ps2_stubs
 
             playback.videoSequenceSyncBuffer.clear();
             flushDecoderIfEnded(playback);
-            if (!playback.decodedFrames.empty())
-            {
-                clearNoFrameStall(playback);
-            }
         }
 
         void erasePssPrefix(MpegPlaybackState &playback, size_t count)
@@ -1190,10 +1105,6 @@ namespace ps2_stubs
                 playback.pssGuestAddrs.push_back(guestAddr + static_cast<uint32_t>(i));
             }
             processPssBuffer(mpegAddr, playback, callbackEvents);
-            if (!playback.decodedFrames.empty())
-            {
-                clearNoFrameStall(playback);
-            }
         }
 
         size_t appendGuestBytes(uint32_t mpegAddr,
@@ -1317,15 +1228,6 @@ namespace ps2_stubs
                 return;
             }
 
-            thread_local PS2Runtime *s_callbackStackRuntime = nullptr;
-            thread_local uint32_t s_callbackStackTop = 0u;
-            if (s_callbackStackRuntime != runtime || s_callbackStackTop == 0u)
-            {
-                constexpr uint32_t kCallbackStackSize = 0x4000u;
-                s_callbackStackRuntime = runtime;
-                s_callbackStackTop = runtime->reserveAsyncCallbackStack(kCallbackStackSize, 16u);
-            }
-
             const uint32_t cbDataAddr = runtime->guestMalloc(kMpegCallbackDataSize, 16u);
             if (cbDataAddr == 0u)
             {
@@ -1342,61 +1244,18 @@ namespace ps2_stubs
             SET_GPR_U32(&callbackCtx, 5, cbDataAddr);
             SET_GPR_U32(&callbackCtx, 6, callback.data);
             SET_GPR_U32(&callbackCtx, 7, 0u);
-            SET_GPR_U32(&callbackCtx, 29, (s_callbackStackTop != 0u) ? s_callbackStackTop : (PS2_RAM_SIZE - 0x10u));
+            SET_GPR_U32(&callbackCtx, 29, 0u);
             SET_GPR_U32(&callbackCtx, 31, 0u);
             callbackCtx.pc = callback.func;
 
-            uint32_t steps = 0u;
-            bool reschedulePending = false;
-            uint64_t handoffBaseline = 0u;
+            GuestInvocation invocation{};
+            invocation.kind = GuestInvocationKind::RpcCallback;
+            invocation.context = callbackCtx;
+            invocation.onComplete = [runtime, cbDataAddr](const R5900Context &, R5900Context &)
             {
-                PS2Runtime::GuestExecutionScope guestExecution(runtime);
-                PS2Runtime::DeferredGuestYieldScope deferYield(reschedulePending);
-
-                while (callbackCtx.pc != 0u && !runtime->isStopRequested() && steps < kMpegCallbackMaxSteps)
-                {
-                    if (!runtime->hasFunction(callbackCtx.pc))
-                    {
-                        static uint32_t badPcLogCount = 0u;
-                        if (badPcLogCount < 16u)
-                        {
-                            std::cerr << "[MPEG:callback:bad-pc] cb=0x" << std::hex << callback.func
-                                      << " pc=0x" << callbackCtx.pc
-                                      << " ra=0x" << getRegU32(&callbackCtx, 31)
-                                      << std::dec << std::endl;
-                            ++badPcLogCount;
-                        }
-                        break;
-                    }
-
-                    PS2Runtime::RecompiledFunction step = runtime->lookupFunction(callbackCtx.pc);
-                    if (!step)
-                    {
-                        break;
-                    }
-
-                    step(rdram, &callbackCtx, runtime);
-                    ++steps;
-                }
-                handoffBaseline = runtime->guestExecutionHandoffEpochSnapshot();
-            }
-            if (reschedulePending && !runtime->isStopRequested())
-            {
-                runtime->waitForGuestExecutionHandoff(handoffBaseline);
-            }
-
-            if (steps >= kMpegCallbackMaxSteps)
-            {
-                static uint32_t stepLimitLogCount = 0u;
-                if (stepLimitLogCount < 16u)
-                {
-                    std::cerr << "[MPEG:callback:step-limit] cb=0x" << std::hex << callback.func
-                              << " pc=0x" << callbackCtx.pc << std::dec << std::endl;
-                    ++stepLimitLogCount;
-                }
-            }
-
-            runtime->guestFree(cbDataAddr);
+                runtime->guestFree(cbDataAddr);
+            };
+            runtime->eeScheduler().queueInvocation(std::move(invocation));
         }
 
         void dispatchStreamCallbacks(uint8_t *rdram,
@@ -1428,7 +1287,6 @@ namespace ps2_stubs
                 return;
             }
 
-            PS2Runtime::GuestExecutionReleaseScope releaseGuestExecution(runtime);
             dispatchStreamCallbacks(rdram, ctx, runtime, events);
         }
 
@@ -1543,11 +1401,27 @@ namespace ps2_stubs
     {
         std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
         resetMpegStubStateUnlocked();
-        g_mpeg_cv.notify_all();
     }
 
-    void notifyMpegCdStreamStart()
+    void enqueueMpegDecodedFrameForTesting(uint32_t mpegAddr)
     {
+        constexpr int kTestFrameWidth = 16;
+        constexpr int kTestFrameHeight = 16;
+
+        MpegDecodedFrame frame;
+        frame.width = kTestFrameWidth;
+        frame.height = kTestFrameHeight;
+        frame.rgba.resize(static_cast<size_t>(kTestFrameWidth * kTestFrameHeight * 4), 0x80u);
+
+        std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
+        MpegPlaybackState &playback = getPlaybackState(mpegAddr);
+        playback.sawInput = true;
+        playback.decodedFrames.push_back(std::move(frame));
+    }
+
+    void notifyMpegCdStreamStart(PS2Runtime *runtime)
+    {
+        (void)runtime;
         std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
         ++g_mpeg_stub_state.cdStreamGeneration;
         g_mpeg_stub_state.currentCdStreamEofSeen = false;
@@ -1566,23 +1440,26 @@ namespace ps2_stubs
             std::cerr << "[MPEG:CdStreamStart] generation=" << g_mpeg_stub_state.cdStreamGeneration
                       << " reopened=" << g_mpeg_stub_state.playbackByMpeg.size() << std::endl;
         });
-        g_mpeg_cv.notify_all();
     }
 
-    void notifyMpegCdStreamEof()
+    void notifyMpegCdStreamEof(PS2Runtime *runtime)
     {
-        std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
-        g_mpeg_stub_state.currentCdStreamEofSeen = true;
+        std::vector<uint32_t> completedMpegIds;
         bool changed = false;
-        for (auto &[mpegAddr, playback] : g_mpeg_stub_state.playbackByMpeg)
         {
-            if (!playback.sawInput || playback.streamEnded)
+            std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
+            g_mpeg_stub_state.currentCdStreamEofSeen = true;
+            for (auto &[mpegAddr, playback] : g_mpeg_stub_state.playbackByMpeg)
             {
-                continue;
-            }
+                completedMpegIds.push_back(mpegAddr);
+                if (!playback.sawInput || playback.streamEnded)
+                {
+                    continue;
+                }
 
-            finishPlaybackStream(mpegAddr, playback);
-            changed = true;
+                finishPlaybackStream(mpegAddr, playback);
+                changed = true;
+            }
         }
 
         if (changed)
@@ -1595,52 +1472,58 @@ namespace ps2_stubs
                 });
                 ++s_eofLogCount;
             }
-            g_mpeg_cv.notify_all();
+        }
+        if (runtime)
+        {
+            for (const uint32_t mpegAddr : completedMpegIds)
+            {
+                runtime->eeScheduler().completeExternalWait(kMpegPictureWaitType, mpegAddr, KE_OK);
+            }
         }
     }
 
     void sceMpegFlush(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         (void)rdram;
-        (void)runtime;
-
         const uint32_t mpegAddr = getRegU32(ctx, 4);
-        std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
-        MpegPlaybackState &playback = getPlaybackState(mpegAddr);
-        if (playback.decoder)
         {
-            playback.decoder->flush(playback.decodedFrames);
+            std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
+            MpegPlaybackState &playback = getPlaybackState(mpegAddr);
+            if (playback.decoder)
+            {
+                playback.decoder->flush(playback.decodedFrames);
+            }
         }
-        g_mpeg_cv.notify_all();
+        runtime->eeScheduler().completeExternalWait(kMpegPictureWaitType, mpegAddr, KE_OK);
         setReturnS32(ctx, 0);
     }
 
     void sceMpegAddBs(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        (void)runtime;
-
         const uint32_t mpegAddr = getRegU32(ctx, 4);
         const uint32_t dataAddr = getRegU32(ctx, 5);
         const uint32_t byteCount = getRegU32(ctx, 6);
 
-        std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
-        MpegPlaybackState &playback = getPlaybackState(mpegAddr);
         size_t copied = 0u;
-        while (copied < byteCount)
         {
-            const uint32_t curAddr = dataAddr + static_cast<uint32_t>(copied);
-            const uint32_t offset = curAddr & PS2_RAM_MASK;
-            const size_t chunk = std::min<size_t>(static_cast<size_t>(byteCount) - copied, PS2_RAM_SIZE - offset);
-            const uint8_t *src = getConstMemPtr(rdram, curAddr);
-            if (!src || chunk == 0u)
+            std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
+            MpegPlaybackState &playback = getPlaybackState(mpegAddr);
+            while (copied < byteCount)
             {
-                break;
+                const uint32_t curAddr = dataAddr + static_cast<uint32_t>(copied);
+                const uint32_t offset = curAddr & PS2_RAM_MASK;
+                const size_t chunk = std::min<size_t>(static_cast<size_t>(byteCount) - copied, PS2_RAM_SIZE - offset);
+                const uint8_t *src = getConstMemPtr(rdram, curAddr);
+                if (!src || chunk == 0u)
+                {
+                    break;
+                }
+                feedElementaryStream(playback, src, chunk);
+                copied += chunk;
             }
-            feedElementaryStream(playback, src, chunk);
-            copied += chunk;
         }
 
-        g_mpeg_cv.notify_all();
+        runtime->eeScheduler().completeExternalWait(kMpegPictureWaitType, mpegAddr, KE_OK);
         setReturnS32(ctx, static_cast<int32_t>(copied));
     }
 
@@ -1801,12 +1684,14 @@ namespace ps2_stubs
     void sceMpegDelete(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         (void)rdram;
-        (void)runtime;
 
         const uint32_t mpegAddr = getRegU32(ctx, 4);
-        std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
-        g_mpeg_stub_state.callbacksByMpeg.erase(mpegAddr);
-        g_mpeg_stub_state.playbackByMpeg.erase(mpegAddr);
+        {
+            std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
+            g_mpeg_stub_state.callbacksByMpeg.erase(mpegAddr);
+            g_mpeg_stub_state.playbackByMpeg.erase(mpegAddr);
+        }
+        runtime->eeScheduler().completeExternalWait(kMpegPictureWaitType, mpegAddr, KE_WAIT_DELETE);
         setReturnU32(ctx, 0u);
     }
 
@@ -1821,14 +1706,13 @@ namespace ps2_stubs
         size_t decodedCount = 0u;
         uint32_t traceIdx = 0u;
         {
-            PS2Runtime::GuestExecutionReleaseScope releaseGuestExecution(runtime);
             std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
             MpegPlaybackState &playback = getPlaybackState(mpegAddr);
             consumed = appendGuestBytes(mpegAddr, playback, rdram, dataAddr, byteCount, callbackEvents);
             decodedCount = playback.decodedFrames.size();
             traceIdx = g_mpeg_stub_state.demuxPssTraceCount++;
         }
-        g_mpeg_cv.notify_all();
+        runtime->eeScheduler().completeExternalWait(kMpegPictureWaitType, mpegAddr, KE_OK);
 
         if (traceIdx < 32u)
         {
@@ -1872,8 +1756,6 @@ namespace ps2_stubs
         size_t decodedCount = 0u;
         uint32_t traceIdx = 0u;
         {
-            // This prevents an ABBA deadlock with sceMpegGetPicture on thread 5, need investigation on other games
-            PS2Runtime::GuestExecutionReleaseScope releaseGuestExecution(runtime);
             std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
             MpegPlaybackState &playback = getPlaybackState(mpegAddr);
             consumed = appendGuestRingBytes(
@@ -1888,7 +1770,7 @@ namespace ps2_stubs
             decodedCount = playback.decodedFrames.size();
             traceIdx = g_mpeg_stub_state.demuxRingTraceCount++;
         }
-        g_mpeg_cv.notify_all();
+        runtime->eeScheduler().completeExternalWait(kMpegPictureWaitType, mpegAddr, KE_OK);
 
         if (traceIdx < 32u)
         {
@@ -1959,84 +1841,36 @@ namespace ps2_stubs
         bool haveFrame = false;
         MpegDecodedFrame frame;
         {
-            PS2Runtime::GuestExecutionReleaseScope releaseGuestExecution(runtime);
             std::unique_lock<std::mutex> lock(g_mpeg_stub_mutex);
             MpegPlaybackState &playback = getPlaybackState(mpegAddr);
-            const uint64_t waitCdStreamGeneration = g_mpeg_stub_state.cdStreamGeneration;
-
-            if (playback.decodedFrames.empty())
+            if (playback.decodedFrames.empty() &&
+                !g_mpeg_stub_state.currentCdStreamEofSeen &&
+                !playback.streamEnded &&
+                !playback.decoderFailed)
             {
-                playback.consecutiveEmptyGetPicture++;
                 if (g_mpeg_stub_state.getPictureWaitTraceCount < 32u)
                 {
                     PS2_IF_AGRESSIVE_LOGS({
                         std::cerr << "[MPEG:GetPicture] waiting for frames, mpeg=0x" << std::hex << mpegAddr
                                   << std::dec << " ended=" << playback.streamEnded
                                   << " failed=" << playback.decoderFailed
-                                  << " sawInput=" << playback.sawInput
-                                  << " consec=" << playback.consecutiveEmptyGetPicture << std::endl;
+                                  << " sawInput=" << playback.sawInput << std::endl;
                     });
                     ++g_mpeg_stub_state.getPictureWaitTraceCount;
                 }
-            }
-
-            std::shared_ptr<ThreadInfo> currentThreadInfo = nullptr;
-            {
-                std::lock_guard<std::mutex> mapLock(g_thread_map_mutex);
-                auto it = g_threads.find(g_currentThreadId);
-                if (it != g_threads.end())
-                    currentThreadInfo = it->second;
-            }
-
-            const auto noFrameWaitStart = std::chrono::steady_clock::now();
-            while (runtime &&
-                   g_mpeg_stub_state.playbackByMpeg.find(mpegAddr) != g_mpeg_stub_state.playbackByMpeg.end() &&
-                   getPlaybackState(mpegAddr).decodedFrames.empty() &&
-                   !getPlaybackState(mpegAddr).streamEnded &&
-                   !getPlaybackState(mpegAddr).decoderFailed &&
-                   g_mpeg_stub_state.cdStreamGeneration == waitCdStreamGeneration &&
-                   !runtime->isStopRequested() &&
-                   (!currentThreadInfo || !currentThreadInfo->terminated.load(std::memory_order_relaxed)))
-            {
-                g_mpeg_cv.wait_for(lock, std::chrono::milliseconds(8));
-
-                auto playbackIt = g_mpeg_stub_state.playbackByMpeg.find(mpegAddr);
-                if (playbackIt == g_mpeg_stub_state.playbackByMpeg.end())
-                {
-                    break;
-                }
-
-                MpegPlaybackState &waitPlayback = playbackIt->second;
-                if (maybeFinishNoFrameStall(mpegAddr, waitPlayback))
-                {
-                    break;
-                }
-
-                if (!g_mpeg_stub_state.currentCdStreamEofSeen &&
-                    std::chrono::steady_clock::now() - noFrameWaitStart >= kMpegGetPictureNoFrameWaitTimeout)
-                {
-                    static uint32_t s_noFrameYieldLogCount = 0u;
-                    if (s_noFrameYieldLogCount < 16u)
+                lock.unlock();
+                runtime->eeScheduler().waitExternal(
+                    EeWaitReason::Mpeg,
+                    kMpegPictureWaitType,
+                    mpegAddr,
+                    [rdram, runtime](R5900Context &resumeContext)
                     {
-                        PS2_IF_AGRESSIVE_LOGS({
-                            std::cerr << "[MPEG:GetPicture:yield] mpeg=0x" << std::hex << mpegAddr
-                                      << std::dec << " generation=" << g_mpeg_stub_state.cdStreamGeneration
-                                      << " sawInput=" << waitPlayback.sawInput
-                                      << " served=" << waitPlayback.picturesServed
-                                      << " cdEof=" << g_mpeg_stub_state.currentCdStreamEofSeen
-                                      << std::endl;
-                        });
-                        ++s_noFrameYieldLogCount;
-                    }
-                    break;
-                }
-            }
-
-            if (g_mpeg_stub_state.playbackByMpeg.find(mpegAddr) == g_mpeg_stub_state.playbackByMpeg.end())
-            {
-                // The MPEG decoder was deleted while we were waiting.
-                setReturnS32(ctx, -1);
-                return;
+                        if (static_cast<int32_t>(getRegU32(&resumeContext, 2)) < 0)
+                        {
+                            return;
+                        }
+                        sceMpegGetPicture(rdram, &resumeContext, runtime);
+                    });
             }
 
             if (!playback.decodedFrames.empty())
@@ -2049,9 +1883,6 @@ namespace ps2_stubs
                 height = playback.height;
                 frameCount = playback.picturesServed;
                 playback.picturesServed += 1u;
-                playback.consecutiveEmptyGetPicture = 0u;
-                playback.lastFrame = frame;
-                playback.hasLastFrame = true;
                 haveFrame = true;
                 if (g_mpeg_stub_state.pictureTraceCount < 32u)
                 {
@@ -2064,41 +1895,9 @@ namespace ps2_stubs
                     });
                     ++g_mpeg_stub_state.pictureTraceCount;
                 }
-                if (!playback.decodedFrames.empty())
-                {
-                    clearNoFrameStall(playback);
-                }
-            }
-            else if (!g_mpeg_stub_state.currentCdStreamEofSeen &&
-                     playback.sawInput &&
-                     playback.hasLastFrame &&
-                     playback.picturesServed > 0u &&
-                     !playback.streamEnded &&
-                     !playback.decoderFailed)
-            {
-                frame = playback.lastFrame;
-                width = static_cast<uint32_t>(frame.width);
-                height = static_cast<uint32_t>(frame.height);
-                frameCount = playback.picturesServed;
-                playback.picturesServed += 1u;
-                playback.consecutiveEmptyGetPicture = 0u;
-                haveFrame = true;
-
-                static uint32_t s_duplicateFrameLogCount = 0u;
-                if (s_duplicateFrameLogCount < 16u)
-                {
-                    PS2_IF_AGRESSIVE_LOGS({
-                        std::cerr << "[MPEG:GetPicture:DUP] mpeg=0x" << std::hex << mpegAddr
-                                  << std::dec << " generation=" << g_mpeg_stub_state.cdStreamGeneration
-                                  << " frame=" << frameCount
-                                  << " size=" << width << "x" << height << std::endl;
-                    });
-                    ++s_duplicateFrameLogCount;
-                }
             }
             else
             {
-                maybeFinishNoFrameStall(mpegAddr, playback);
                 width = playback.width;
                 height = playback.height;
                 frameCount = playback.picturesServed;
@@ -2147,8 +1946,6 @@ namespace ps2_stubs
     void sceMpegInit(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         (void)rdram;
-        (void)runtime;
-
         std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
         const uint64_t cdStreamGeneration = g_mpeg_stub_state.cdStreamGeneration;
         const bool currentCdStreamEofSeen = g_mpeg_stub_state.currentCdStreamEofSeen;
@@ -2156,21 +1953,17 @@ namespace ps2_stubs
         g_mpeg_stub_state.initialized = true;
         g_mpeg_stub_state.cdStreamGeneration = cdStreamGeneration;
         g_mpeg_stub_state.currentCdStreamEofSeen = currentCdStreamEofSeen;
-        g_mpeg_cv.notify_all();
         setReturnU32(ctx, 0u);
     }
 
     void sceMpegIsEnd(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         (void)rdram;
-        // runtime used below for GuestExecutionReleaseScope
         const uint32_t mpegAddr = getRegU32(ctx, 4);
 
-        PS2Runtime::GuestExecutionReleaseScope releaseGuestExecution(runtime);
         std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
         g_mpeg_stub_state.initialized = true;
         MpegPlaybackState &playback = getPlaybackState(mpegAddr);
-        maybeFinishNoFrameStall(mpegAddr, playback);
         const bool ended = playback.streamEnded || (playback.decoderFailed && playback.sawInput);
 
         if (g_mpeg_stub_state.isEndTraceCount < 16u)

ps2xRuntime/src/lib/Kernel/Stubs/MPEG.h

@@ -5,8 +5,9 @@
 namespace ps2_stubs
 {
     void resetMpegStubState();
-    void notifyMpegCdStreamStart();
-    void notifyMpegCdStreamEof();
+    void enqueueMpegDecodedFrameForTesting(uint32_t mpegAddr);
+    void notifyMpegCdStreamStart(PS2Runtime *runtime = nullptr);
+    void notifyMpegCdStreamEof(PS2Runtime *runtime = nullptr);
     void sceMpegFlush(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);
     void sceMpegAddBs(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);
     void sceMpegAddCallback(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);

ps2xRuntime/src/lib/Kernel/Syscalls/Common.h

@@ -1,6 +1,7 @@
 #include "ps2_syscalls.h"
 #include "ps2_log.h"
 #include "ps2_runtime.h"
+#include "runtime/ee_scheduler.h"
 #include "ps2_runtime_macros.h"
 #include "ps2_stubs.h"
 #include <iostream>
@@ -14,7 +15,6 @@
 #include <unordered_map>
 #include <unordered_set>
 #include <thread>
-#include <condition_variable>
 #include <atomic>
 #include <filesystem>
 #include <chrono>
@@ -35,10 +35,51 @@ std::string translatePs2Path(const char *ps2Path);
 #include "Helpers/Loader.h"
 #include "Helpers/Runtime.h"
 
-namespace ps2_syscalls
+inline bool resolveEeGuestRange(uint32_t address, size_t size, uint32_t &offset, bool &scratch)
 {
-    inline void yieldGuestExecutionAfterWake(PS2Runtime *runtime)
+    scratch = ps2IsScratchpadAddress(address);
+    if (scratch)
     {
-        runtime->yieldGuestExecutionAfterWake();
+        offset = ps2ScratchpadOffset(address);
+        return size <= PS2_SCRATCHPAD_SIZE && offset <= PS2_SCRATCHPAD_SIZE - size;
     }
+
+    if (address < PS2_RAM_SIZE)
+    {
+        offset = address;
+    }
+    else if ((address >= 0x20000000u && address < 0x40000000u) ||
+             (address >= 0x80000000u && address < 0xC0000000u))
+    {
+        offset = address & 0x1FFFFFFFu;
+    }
+    else
+    {
+        return false;
+    }
+    return size <= PS2_RAM_SIZE && offset <= PS2_RAM_SIZE - size;
+}
+
+template <typename T>
+inline const T *getEeGuestStruct(const uint8_t *rdram, uint32_t address)
+{
+    uint32_t offset = 0;
+    bool scratch = false;
+    if (!rdram || (address & (alignof(T) - 1u)) != 0u ||
+        !resolveEeGuestRange(address, sizeof(T), offset, scratch))
+    {
+        return nullptr;
+    }
+    if (scratch)
+    {
+        const uint8_t *base = ps2GetScratchpadHostPtr();
+        return base ? reinterpret_cast<const T *>(base + offset) : nullptr;
+    }
+    return reinterpret_cast<const T *>(rdram + offset);
+}
+
+template <typename T>
+inline T *getEeGuestStruct(uint8_t *rdram, uint32_t address)
+{
+    return const_cast<T *>(getEeGuestStruct<T>(static_cast<const uint8_t *>(rdram), address));
 }

ps2xRuntime/src/lib/Kernel/Syscalls/Helpers/Runtime.h

@@ -1,153 +1,3 @@
-struct ThreadExitException final : public std::exception
-{
-    const char *what() const noexcept override
-    {
-        return "PS2 Thread Exit";
-    }
-};
-
-static void throwIfTerminated(const std::shared_ptr<ThreadInfo> &info)
-{
-    if (info && info->terminated.load())
-    {
-        throw ThreadExitException();
-    }
-}
-
-// Condition-variable waits in the EE runtime must release the global guest
-// execution mutex, but must not reacquire it while still holding the local
-// wait-object mutex. Reacquiring guest execution while holding a semaphore,
-// thread, event-flag, or vsync mutex can create an ABBA deadlock:
-//
-//   awakened thread: local wait mutex -> waiting for GuestExecutionScope
-//   running thread:  GuestExecutionScope -> waiting for local wait mutex
-//
-// This helper keeps guest execution released for the whole host wait and for
-// any post-wake bookkeeping that needs the local mutex, then unlocks the local
-// mutex before the GuestExecutionReleaseScope destructor reacquires guest code.
-template <typename Lock, typename WaitFn, typename FinishFn>
-static void waitWithGuestExecutionReleasedUntilUnlocked(PS2Runtime *runtime,
-                                                        Lock &lock,
-                                                        WaitFn waitFn,
-                                                        FinishFn finishFn)
-{
-    auto releaseGuestExecution = std::make_unique<PS2Runtime::GuestExecutionReleaseScope>(runtime);
-
-    waitFn();
-    finishFn();
-
-    if (lock.owns_lock())
-    {
-        lock.unlock();
-    }
-
-    releaseGuestExecution.reset();
-}
-
-template <typename Lock, typename WaitFn>
-static void waitWithGuestExecutionReleasedUntilUnlocked(PS2Runtime *runtime, Lock &lock, WaitFn waitFn)
-{
-    waitWithGuestExecutionReleasedUntilUnlocked(runtime, lock, waitFn, []() {});
-}
-
-static void waitWhileSuspended(const std::shared_ptr<ThreadInfo> &info, PS2Runtime *runtime = nullptr)
-{
-    if (!info)
-        return;
-
-    std::unique_lock<std::mutex> lock(info->m);
-    if (info->suspendCount > 0)
-    {
-        info->status = THS_SUSPEND;
-        info->waitType = TSW_NONE;
-        info->waitId = 0;
-
-        bool terminated = false;
-        waitWithGuestExecutionReleasedUntilUnlocked(
-            runtime,
-            lock,
-            [&]()
-            {
-                info->cv.wait(lock, [&]()
-                              { return info->suspendCount == 0 || info->terminated.load(); });
-            },
-            [&]()
-            {
-                terminated = info->terminated.load();
-                if (!terminated)
-                {
-                    info->status = THS_RUN;
-                }
-            });
-
-        if (terminated)
-        {
-            throw ThreadExitException();
-        }
-    }
-}
-
-static std::shared_ptr<ThreadInfo> lookupThreadInfo(int tid)
-{
-    std::lock_guard<std::mutex> lock(g_thread_map_mutex);
-    auto it = g_threads.find(tid);
-    if (it != g_threads.end())
-    {
-        return it->second;
-    }
-    return nullptr;
-}
-
-static std::shared_ptr<ThreadInfo> ensureCurrentThreadInfo(R5900Context *ctx)
-{
-    const int tid = g_currentThreadId;
-    std::lock_guard<std::mutex> lock(g_thread_map_mutex);
-    auto it = g_threads.find(tid);
-    if (it != g_threads.end())
-    {
-        return it->second;
-    }
-
-    auto info = std::make_shared<ThreadInfo>();
-    info->started = true;
-    info->status = THS_RUN;
-    info->currentPriority = info->priority;
-    info->suspendCount = 0;
-    if (ctx)
-    {
-        info->entry = ctx->pc;
-        info->stack = getRegU32(ctx, 29);
-        info->gp = getRegU32(ctx, 28);
-    }
-    info->waitType = TSW_NONE;
-    info->waitId = 0;
-
-    g_threads.emplace(tid, info);
-    return info;
-}
-
-static std::shared_ptr<SemaInfo> lookupSemaInfo(int sid)
-{
-    std::lock_guard<std::mutex> lock(g_sema_map_mutex);
-    auto it = g_semas.find(sid);
-    if (it != g_semas.end())
-    {
-        return it->second;
-    }
-    return nullptr;
-}
-
-static std::shared_ptr<EventFlagInfo> lookupEventFlagInfo(int eid)
-{
-    std::lock_guard<std::mutex> lock(g_event_flag_map_mutex);
-    auto it = g_eventFlags.find(eid);
-    if (it != g_eventFlags.end())
-    {
-        return it->second;
-    }
-    return nullptr;
-}
-
 static void setRegU32(R5900Context *ctx, int reg, uint32_t value)
 {
     if (!ctx || reg < 0 || reg > 31)
@@ -155,104 +5,6 @@ static void setRegU32(R5900Context *ctx, int reg, uint32_t value)
     SET_GPR_U32(ctx, reg, value);
 }
 
-static std::chrono::microseconds alarmTicksToDuration(uint16_t ticks)
-{
-    constexpr uint64_t kAlarmTickUsec = 64u; // Approximate EE H-SYNC tick period.
-    const uint64_t clampedTicks = (ticks == 0u) ? 1u : static_cast<uint64_t>(ticks);
-    return std::chrono::microseconds(clampedTicks * kAlarmTickUsec);
-}
-
-static void ensureAlarmWorkerRunning()
-{
-    std::call_once(g_alarm_worker_once, []()
-                   { std::thread([]()
-                                 {
-            for (;;)
-            {
-                std::shared_ptr<AlarmInfo> readyAlarm;
-                {
-                    std::unique_lock<std::mutex> lock(g_alarm_mutex);
-                    while (!readyAlarm)
-                    {
-                        if (g_alarms.empty())
-                        {
-                            g_alarm_cv.wait(lock);
-                            continue;
-                        }
-
-                        auto nextIt = std::min_element(g_alarms.begin(), g_alarms.end(),
-                                                       [](const auto &a, const auto &b)
-                                                       {
-                                                           return a.second->dueAt < b.second->dueAt;
-                                                       });
-                        if (nextIt == g_alarms.end())
-                        {
-                            g_alarm_cv.wait(lock);
-                            continue;
-                        }
-
-                        const auto now = std::chrono::steady_clock::now();
-                        if (nextIt->second->dueAt > now)
-                        {
-                            g_alarm_cv.wait_until(lock, nextIt->second->dueAt);
-                            continue;
-                        }
-
-                        readyAlarm = nextIt->second;
-                        g_alarms.erase(nextIt);
-                    }
-                }
-
-                if (!readyAlarm || !readyAlarm->runtime || !readyAlarm->rdram || !readyAlarm->handler)
-                {
-                    continue;
-                }
-                if (!readyAlarm->runtime->hasFunction(readyAlarm->handler))
-                {
-                    continue;
-                }
-
-                try
-                {
-                    constexpr uint32_t kAlarmCallbackStackSize = 0x4000u;
-                    thread_local PS2Runtime *s_alarmStackRuntime = nullptr;
-                    thread_local uint32_t s_alarmStackTop = 0u;
-                    if (s_alarmStackRuntime != readyAlarm->runtime || s_alarmStackTop == 0u)
-                    {
-                        s_alarmStackRuntime = readyAlarm->runtime;
-                        s_alarmStackTop = readyAlarm->runtime->reserveAsyncCallbackStack(kAlarmCallbackStackSize, 16u);
-                    }
-
-                    R5900Context callbackCtx{};
-                    setRegU32(&callbackCtx, 28, readyAlarm->gp);
-                    setRegU32(&callbackCtx, 29,
-                              (s_alarmStackTop != 0u) ? s_alarmStackTop : (PS2_RAM_SIZE - 0x10u));
-                    setRegU32(&callbackCtx, 31, 0);
-                    setRegU32(&callbackCtx, 4, static_cast<uint32_t>(readyAlarm->id));
-                    setRegU32(&callbackCtx, 5, static_cast<uint32_t>(readyAlarm->ticks));
-                    setRegU32(&callbackCtx, 6, readyAlarm->commonArg);
-                    setRegU32(&callbackCtx, 7, 0);
-                    callbackCtx.pc = readyAlarm->handler;
-
-                    PS2Runtime::RecompiledFunction func = readyAlarm->runtime->lookupFunction(readyAlarm->handler);
-                    func(readyAlarm->rdram, &callbackCtx, readyAlarm->runtime);
-                }
-                catch (const ThreadExitException &)
-                {
-                }
-                catch (const std::exception &e)
-                {
-                    static int alarmExceptionLogs = 0;
-                    if (alarmExceptionLogs < 8)
-                    {
-                        std::cerr << "[SetAlarm] callback exception: " << e.what() << std::endl;
-                        ++alarmExceptionLogs;
-                    }
-                }
-            } })
-                         .detach(); });
-}
-
 static void rpcCopyToRdram(uint8_t *rdram, uint32_t dst, uint32_t src, size_t size)
 {
     if (!rdram || size == 0)
@@ -331,146 +83,6 @@ static bool readStackU32(uint8_t *rdram, uint32_t sp, uint32_t offset, uint32_t
     return true;
 }
 
-enum class RpcInvokeExitReason
-{
-    Returned,
-    NullPc,
-    MissingFunction,
-    StepLimit,
-    SamePcLimit
-};
-
-static const char *rpcInvokeExitReasonName(RpcInvokeExitReason reason)
-{
-    switch (reason)
-    {
-    case RpcInvokeExitReason::Returned:
-        return "returned";
-    case RpcInvokeExitReason::NullPc:
-        return "null-pc";
-    case RpcInvokeExitReason::MissingFunction:
-        return "missing-function";
-    case RpcInvokeExitReason::StepLimit:
-        return "step-limit";
-    case RpcInvokeExitReason::SamePcLimit:
-        return "same-pc-limit";
-    default:
-        return "unknown";
-    }
-}
-
-static bool rpcInvokeFunction(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime,
-                              uint32_t funcAddr, uint32_t a0, uint32_t a1, uint32_t a2, uint32_t a3, uint32_t *outV0)
-{
-    if (!runtime || !ctx || !funcAddr || !runtime->hasFunction(funcAddr))
-        return false;
-
-    constexpr uint32_t kRpcInvokeStackSize = 0x4000u;
-    constexpr uint32_t kRpcInvokeReturnSentinel = 0x00FFF000u;
-    constexpr uint32_t kRpcInvokeMaxSteps = 0x8000u;
-
-    R5900Context tmp = *ctx;
-    setRegU32(&tmp, 4, a0);
-    setRegU32(&tmp, 5, a1);
-    setRegU32(&tmp, 6, a2);
-    setRegU32(&tmp, 7, a3);
-
-    thread_local uint32_t s_rpcInvokeStackBase = 0u;
-    thread_local uint32_t s_rpcInvokeStackTop = 0u;
-    if (s_rpcInvokeStackTop == 0u)
-    {
-        const uint32_t stackBase = runtime->guestMalloc(kRpcInvokeStackSize, 16u);
-        if (stackBase != 0u)
-        {
-            s_rpcInvokeStackBase = stackBase;
-            s_rpcInvokeStackTop = (stackBase + kRpcInvokeStackSize) & ~0xFu;
-        }
-    }
-    if (s_rpcInvokeStackTop != 0u)
-    {
-        setRegU32(&tmp, 29, s_rpcInvokeStackTop);
-    }
-    (void)s_rpcInvokeStackBase;
-
-    setRegU32(&tmp, 31, kRpcInvokeReturnSentinel);
-    tmp.pc = funcAddr;
-
-    uint32_t steps = 0u;
-    uint32_t lastPc = 0xFFFFFFFFu;
-    uint32_t samePcCount = 0u;
-    RpcInvokeExitReason exitReason = RpcInvokeExitReason::MissingFunction;
-    while (tmp.pc != 0u &&
-           tmp.pc != kRpcInvokeReturnSentinel &&
-           runtime->hasFunction(tmp.pc) &&
-           steps < kRpcInvokeMaxSteps)
-    {
-        const uint32_t pc = tmp.pc;
-        if (pc == lastPc)
-        {
-            ++samePcCount;
-            if (samePcCount > 0x2000u)
-            {
-                exitReason = RpcInvokeExitReason::SamePcLimit;
-                break;
-            }
-        }
-        else
-        {
-            lastPc = pc;
-            samePcCount = 0u;
-        }
-
-        PS2Runtime::RecompiledFunction func = runtime->lookupFunction(pc);
-        {
-            PS2Runtime::GuestExecutionScope guestExecution(runtime);
-            func(rdram, &tmp, runtime);
-        }
-        ++steps;
-    }
-
-    if (outV0)
-    {
-        *outV0 = getRegU32(&tmp, 2);
-    }
-
-    if (tmp.pc == kRpcInvokeReturnSentinel)
-    {
-        return true;
-    }
-
-    if (tmp.pc == 0u)
-    {
-        exitReason = RpcInvokeExitReason::NullPc;
-    }
-    else if (steps >= kRpcInvokeMaxSteps)
-    {
-        exitReason = RpcInvokeExitReason::StepLimit;
-    }
-    else if (!runtime->hasFunction(tmp.pc))
-    {
-        exitReason = RpcInvokeExitReason::MissingFunction;
-    }
-
-    static std::atomic<uint32_t> s_rpcInvokeFailureLogs{0u};
-    constexpr uint32_t kMaxRpcInvokeFailureLogs = 64u;
-    const uint32_t logIndex = s_rpcInvokeFailureLogs.fetch_add(1u, std::memory_order_relaxed);
-    if (logIndex < kMaxRpcInvokeFailureLogs)
-    {
-        PS2_IF_AGRESSIVE_LOGS({
-            std::cerr << "[SyscallOverride:invoke-failed]"
-                      << " func=0x" << std::hex << funcAddr
-                      << " exitPc=0x" << tmp.pc
-                      << " ra=0x" << getRegU32(&tmp, 31)
-                      << std::dec
-                      << " steps=" << steps
-                      << " reason=" << rpcInvokeExitReasonName(exitReason)
-                      << std::endl;
-        });
-    }
-
-    return false;
-}
-
 static uint32_t rpcAllocPacketAddr(uint8_t *rdram)
 {
     if (kRpcPacketPoolCount == 0)
@@ -493,28 +105,6 @@ static uint32_t rpcAllocServerAddr(uint8_t *rdram)
     return addr;
 }
 
-struct IrqHandlerInfo
-{
-    int id = 0;
-    uint32_t cause = 0;
-    uint32_t handler = 0;
-    uint32_t arg = 0;
-    uint32_t gp = 0;
-    uint32_t sp = 0;
-    bool enabled = true;
-    int order = 0;
-};
-
-static std::unordered_map<int, IrqHandlerInfo> g_intcHandlers;
-static std::unordered_map<int, IrqHandlerInfo> g_dmacHandlers;
-static int g_nextIntcHandlerId = 1;
-static int g_nextDmacHandlerId = 1;
-
-static int g_intc_head_order = 0;
-static int g_intc_tail_order = 1000;
-static int g_dmac_head_order = 0;
-static int g_dmac_tail_order = 1000;
-
 inline std::string translatePs2Path(const char *ps2Path)
 {
     if (!ps2Path || !*ps2Path)

ps2xRuntime/src/lib/Kernel/Syscalls/Helpers/State.h

@@ -2,40 +2,10 @@
 
 #include <cstddef>
 #include <cstdint>
-#include <thread>
 
 inline std::unordered_map<int, FILE *> g_fileDescriptors;
 inline int g_nextFd = 3; // Start after stdin, stdout, stderr
 
-struct ThreadInfo
-{
-    uint32_t entry = 0;
-    uint32_t stack = 0;
-    uint32_t stackSize = 0;
-    uint32_t gp = 0;
-    uint32_t priority = 0;
-    uint32_t attr = 0;
-    uint32_t option = 0;
-    uint32_t arg = 0;
-    bool started = false;
-    bool ownsStack = false;
-    uint32_t tlsBase = 0;
-
-    // Thread Status
-    int status = 0x10; // THS_DORMANT
-    int waitType = 0;  // TSW_NONE
-    int waitId = 0;
-    int wakeupCount = 0;
-    int currentPriority = 0;
-    int suspendCount = 0;
-    std::atomic<uint32_t> currentPc{0};
-
-    std::mutex m;
-    std::condition_variable cv;
-    std::atomic<bool> forceRelease{false};
-    std::atomic<bool> terminated{false};
-};
-
 // Thread status
 #define THS_RUN 0x01
 #define THS_READY 0x02
@@ -138,6 +108,24 @@ struct ee_thread_status_t
     uint32_t wakeupCount; // 0x2C
 };
 
+// PS2SDK EE kernel.h t_ee_thread. CreateThread consumes this full 0x24-byte
+// descriptor; it is not the attr-first IOP thread descriptor.
+struct ee_thread_t
+{
+    int status;
+    uint32_t func;
+    uint32_t stack;
+    int stack_size;
+    uint32_t gp_reg;
+    int initial_priority;
+    int current_priority;
+    uint32_t attr;
+    uint32_t option;
+};
+
+static_assert(sizeof(ee_thread_t) == 0x24u);
+static_assert(sizeof(ee_thread_status_t) == 0x30u);
+
 struct ee_sema_t
 {
     int count;
@@ -148,43 +136,7 @@ struct ee_sema_t
     uint32_t option;
 };
 
-struct SemaInfo
-{
-    int count = 0;
-    int maxCount = 0;
-    int initCount = 0;
-    uint32_t attr = 0;
-    uint32_t option = 0;
-    int waiters = 0;
-    bool deleted = false;
-    std::mutex m;
-    std::condition_variable cv;
-};
-
-struct EventFlagInfo
-{
-    uint32_t attr = 0;
-    uint32_t option = 0;
-    uint32_t initBits = 0;
-    uint32_t bits = 0;
-    int waiters = 0;
-    bool deleted = false;
-    std::mutex m;
-    std::condition_variable cv;
-};
-
-struct AlarmInfo
-{
-    int id = 0;
-    uint16_t ticks = 0;
-    uint32_t handler = 0;
-    uint32_t commonArg = 0;
-    uint32_t gp = 0;
-    uint32_t sp = 0;
-    uint8_t *rdram = nullptr;
-    PS2Runtime *runtime = nullptr;
-    std::chrono::steady_clock::time_point dueAt;
-};
+static_assert(sizeof(ee_sema_t) == 0x18u);
 
 struct io_stat_t
 {
@@ -204,136 +156,8 @@ static constexpr uint32_t kFioSoIROth = 0x0004;
 static constexpr uint32_t kFioSoIWOth = 0x0002;
 static constexpr uint32_t kFioSoIXOth = 0x0001;
 
-inline std::unordered_map<int, std::shared_ptr<ThreadInfo>> g_threads;
-inline int g_nextThreadId = 2; // Reserve 1 for the main thread
-inline thread_local int g_currentThreadId = 1;
-inline std::mutex g_thread_map_mutex;
-inline std::unordered_map<int, std::thread> g_hostThreads;
-inline std::mutex g_host_thread_mutex;
-
-inline std::unordered_map<int, std::shared_ptr<SemaInfo>> g_semas;
-inline int g_nextSemaId = 1;
-inline std::mutex g_sema_map_mutex;
-inline std::unordered_map<int, std::shared_ptr<EventFlagInfo>> g_eventFlags;
-inline int g_nextEventFlagId = 1;
-inline std::mutex g_event_flag_map_mutex;
-inline std::unordered_map<int, std::shared_ptr<AlarmInfo>> g_alarms;
-inline int g_nextAlarmId = 1;
-inline std::mutex g_alarm_mutex;
-inline std::condition_variable g_alarm_cv;
-inline std::once_flag g_alarm_worker_once;
-inline std::atomic<int> g_activeThreads{0};
 inline std::mutex g_fd_mutex;
 
-static void registerHostThread(int tid, std::thread worker)
-{
-    std::thread stale;
-    {
-        std::lock_guard<std::mutex> lock(g_host_thread_mutex);
-        auto it = g_hostThreads.find(tid);
-        if (it != g_hostThreads.end())
-        {
-            stale = std::move(it->second);
-            g_hostThreads.erase(it);
-        }
-        g_hostThreads.emplace(tid, std::move(worker));
-    }
-
-    if (stale.joinable())
-    {
-        if (stale.get_id() == std::this_thread::get_id())
-        {
-            stale.detach();
-        }
-        else
-        {
-            stale.join();
-        }
-    }
-}
-
-static void joinHostThreadById(int tid)
-{
-    std::thread worker;
-    {
-        std::lock_guard<std::mutex> lock(g_host_thread_mutex);
-        auto it = g_hostThreads.find(tid);
-        if (it != g_hostThreads.end())
-        {
-            worker = std::move(it->second);
-            g_hostThreads.erase(it);
-        }
-    }
-
-    if (!worker.joinable())
-    {
-        return;
-    }
-
-    if (worker.get_id() == std::this_thread::get_id())
-    {
-        worker.detach();
-    }
-    else
-    {
-        worker.join();
-    }
-}
-
-static void joinAllHostThreads()
-{
-    std::vector<std::thread> workers;
-    {
-        std::lock_guard<std::mutex> lock(g_host_thread_mutex);
-        workers.reserve(g_hostThreads.size());
-        const std::thread::id selfId = std::this_thread::get_id();
-        for (auto it = g_hostThreads.begin(); it != g_hostThreads.end();)
-        {
-            std::thread &worker = it->second;
-            if (worker.joinable() && worker.get_id() == selfId)
-            {
-                ++it;
-                continue;
-            }
-
-            workers.push_back(std::move(worker));
-            it = g_hostThreads.erase(it);
-        }
-    }
-
-    for (auto &worker : workers)
-    {
-        if (!worker.joinable())
-        {
-            continue;
-        }
-        worker.join();
-    }
-}
-
-static void detachAllHostThreads()
-{
-    std::vector<std::thread> workers;
-    {
-        std::lock_guard<std::mutex> lock(g_host_thread_mutex);
-        workers.reserve(g_hostThreads.size());
-        for (auto &entry : g_hostThreads)
-        {
-            workers.push_back(std::move(entry.second));
-        }
-        g_hostThreads.clear();
-    }
-
-    for (auto &worker : workers)
-    {
-        if (!worker.joinable())
-        {
-            continue;
-        }
-        worker.detach();
-    }
-}
-
 struct RpcServerState
 {
     uint32_t sid = 0;
@@ -397,24 +221,11 @@ inline uint32_t g_rpc_next_id = 1;
 inline uint32_t g_rpc_packet_index = 0;
 inline uint32_t g_rpc_server_index = 0;
 inline uint32_t g_rpc_active_queue = 0;
-struct ExitHandlerEntry
-{
-    uint32_t func = 0;
-    uint32_t arg = 0;
-};
-
-inline std::mutex g_exit_handler_mutex;
-inline std::unordered_map<int, std::vector<ExitHandlerEntry>> g_exit_handlers;
-
 inline std::mutex g_bootmode_mutex;
 inline bool g_bootmode_initialized = false;
 inline uint32_t g_bootmode_pool_offset = 0;
 inline std::unordered_map<uint8_t, uint32_t> g_bootmode_addresses;
 
-inline std::mutex g_syscall_override_mutex;
-inline std::unordered_map<uint32_t, uint32_t> g_syscall_overrides;
-inline std::unordered_set<uint32_t> g_syscall_mirror_addrs;
-
 static constexpr uint32_t kGuestSyscallTableGuestBase = 0x80011F80u;
 static constexpr uint32_t kGuestSyscallTablePhysBase = kGuestSyscallTableGuestBase & 0x1FFFFFFFu;
 static constexpr uint32_t kGuestSyscallMirrorLimit = 0x00080000u;

ps2xRuntime/src/lib/Kernel/Syscalls/Interrupt.cpp

@@ -1,538 +1,103 @@
 #include "Common.h"
 #include "Interrupt.h"
-#include "ps2_log.h"
-#include "Stubs/GS.h"
 
 namespace ps2_syscalls
 {
-    namespace interrupt_state
+    namespace
     {
-        constexpr uint32_t kIntcVblankStart = 2u;
-        constexpr uint32_t kIntcVblankEnd = 3u;
-        constexpr auto kVblankPeriod = std::chrono::microseconds(16667);
-        constexpr int kMaxCatchupTicks = 4;
-        constexpr uint32_t kMaxIrqHandlerSteps = 4096u;
-
-        std::mutex g_irq_handler_mutex;
-        std::mutex g_irq_worker_mutex;
-        std::condition_variable g_irq_worker_cv;
-        std::mutex g_vsync_flag_mutex;
-        std::condition_variable g_vsync_cv;
-        std::atomic<bool> g_irq_worker_stop{false};
-        std::atomic<bool> g_irq_worker_running{false};
-        uint32_t g_enabled_intc_mask = 0xFFFFFFFFu;
-        uint32_t g_enabled_dmac_mask = 0xFFFFFFFFu;
-        uint64_t g_vsync_tick_counter = 0u;
-        VSyncFlagRegistration g_vsync_registration{};
-    }
-
-    using namespace interrupt_state;
-
-    static void writeGuestU32NoThrow(uint8_t *rdram, uint32_t addr, uint32_t value)
-    {
-        if (addr == 0u)
+        EeScheduler &scheduler(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
         {
-            return;
+            EeScheduler &result = runtime->eeScheduler();
+            result.bindMainContextForSyscall(*ctx, rdram);
+            return result;
         }
 
-        uint8_t *dst = getMemPtr(rdram, addr);
-        if (!dst)
+        void setCauseEnabled(uint8_t *rdram,
+                             R5900Context *ctx,
+                             PS2Runtime *runtime,
+                             bool dmac,
+                             bool enabled)
         {
-            return;
-        }
-        std::memcpy(dst, &value, sizeof(value));
-    }
-
-    static void writeGuestU64NoThrow(uint8_t *rdram, uint32_t addr, uint64_t value)
-    {
-        if (addr == 0u)
-        {
-            return;
+            setReturnS32(ctx,
+                         scheduler(rdram, ctx, runtime)
+                             .setIrqCauseEnabled(dmac, getRegU32(ctx, 4), enabled));
         }
 
-        uint8_t *dst = getMemPtr(rdram, addr);
-        if (!dst)
+        void addHandler(uint8_t *rdram,
+                        R5900Context *ctx,
+                        PS2Runtime *runtime,
+                        bool dmac)
         {
-            return;
-        }
-        std::memcpy(dst, &value, sizeof(value));
-    }
-
-    static uint32_t readGuestU32NoThrow(uint8_t *rdram, uint32_t addr)
-    {
-        if (addr == 0u)
-        {
-            return 0u;
+            const int id = scheduler(rdram, ctx, runtime)
+                               .addIrqHandler(dmac,
+                                              getRegU32(ctx, 4),
+                                              getRegU32(ctx, 5),
+                                              getRegU32(ctx, 6) != 0u,
+                                              getRegU32(ctx, 7),
+                                              getRegU32(ctx, 28),
+                                              getRegU32(ctx, 29));
+            setReturnS32(ctx, id);
         }
 
-        uint8_t *src = getMemPtr(rdram, addr);
-        if (!src)
+        void removeHandler(uint8_t *rdram,
+                           R5900Context *ctx,
+                           PS2Runtime *runtime,
+                           bool dmac)
         {
-            return 0u;
+            setReturnS32(ctx,
+                         scheduler(rdram, ctx, runtime)
+                             .removeIrqHandler(dmac,
+                                               getRegU32(ctx, 4),
+                                               static_cast<int>(getRegU32(ctx, 5))));
         }
 
-        uint32_t value = 0u;
-        std::memcpy(&value, src, sizeof(value));
-        return value;
-    }
-
-    static uint32_t getAsyncHandlerStackTop(PS2Runtime *runtime)
-    {
-        constexpr uint32_t kAsyncHandlerStackSize = 0x4000u;
-        thread_local PS2Runtime *s_cachedRuntime = nullptr;
-        thread_local uint32_t s_cachedStackTop = 0u;
-
-        if (runtime == nullptr)
+        void setHandlerEnabled(uint8_t *rdram,
+                               R5900Context *ctx,
+                               PS2Runtime *runtime,
+                               bool dmac,
+                               bool enabled)
         {
-            return PS2_RAM_SIZE - 0x10u;
-        }
-
-        if (s_cachedRuntime != runtime || s_cachedStackTop == 0u)
-        {
-            s_cachedRuntime = runtime;
-            s_cachedStackTop = runtime->reserveAsyncCallbackStack(kAsyncHandlerStackSize, 16u);
-        }
-
-        return (s_cachedStackTop != 0u) ? s_cachedStackTop : (PS2_RAM_SIZE - 0x10u);
-    }
-
-    static void dispatchIntcHandlersForCause(uint8_t *rdram, PS2Runtime *runtime, uint32_t cause)
-    {
-        if (!rdram || !runtime)
-        {
-            return;
-        }
-
-        std::vector<IrqHandlerInfo> handlers;
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            if (cause < 32u && (g_enabled_intc_mask & (1u << cause)) == 0u)
-            {
-                return;
-            }
-
-            handlers.reserve(g_intcHandlers.size());
-            for (const auto &[id, info] : g_intcHandlers)
-            {
-                (void)id;
-                if (!info.enabled)
-                {
-                    continue;
-                }
-                if (info.cause != cause)
-                {
-                    continue;
-                }
-                if (info.handler == 0u)
-                {
-                    continue;
-                }
-                handlers.push_back(info);
-            }
-            std::sort(handlers.begin(), handlers.end(), [](const IrqHandlerInfo &a, const IrqHandlerInfo &b)
-                      { return a.order < b.order; });
-        }
-
-        for (const IrqHandlerInfo &info : handlers)
-        {
-            if (!runtime->hasFunction(info.handler))
-            {
-                if (cause == kIntcVblankStart)
-                {
-                    PS2_IF_AGRESSIVE_LOGS({
-                        static std::atomic<uint32_t> s_missingHandlerLogCount{0u};
-                        const uint32_t logIndex = s_missingHandlerLogCount.fetch_add(1u, std::memory_order_relaxed);
-                        if (logIndex < 32u)
-                        {
-                            auto flags = std::cout.flags();
-                            std::cout << "[INTC:missing] cause=" << cause
-                                      << " handler=0x" << std::hex << info.handler
-                                      << std::dec
-                                      << " id=" << info.id
-                                      << std::endl;
-                            std::cout.flags(flags);
-                        }
-                    });
-                }
-                continue;
-            }
-
-            try
-            {
-                R5900Context irqCtx{};
-                SET_GPR_U32(&irqCtx, 28, info.gp);
-                SET_GPR_U32(&irqCtx, 29, getAsyncHandlerStackTop(runtime));
-                SET_GPR_U32(&irqCtx, 31, 0u);
-                SET_GPR_U32(&irqCtx, 4, cause);
-                SET_GPR_U32(&irqCtx, 5, info.arg);
-                SET_GPR_U32(&irqCtx, 6, 0u);
-                SET_GPR_U32(&irqCtx, 7, 0u);
-                irqCtx.pc = info.handler;
-
-                bool reschedulePending = false;
-                uint64_t handoffBaseline = 0u;
-                uint32_t steps = 0u;
-                {
-                    PS2Runtime::GuestExecutionScope guestExecution(runtime);
-                    PS2Runtime::DeferredGuestYieldScope deferYield(reschedulePending);
-
-                    while (irqCtx.pc != 0u && runtime && !runtime->isStopRequested() && steps < kMaxIrqHandlerSteps)
-                    {
-                        PS2Runtime::RecompiledFunction step = runtime->lookupFunction(irqCtx.pc);
-                        if (!step)
-                        {
-                            break;
-                        }
-                        step(rdram, &irqCtx, runtime);
-                        ++steps;
-                    }
-                    handoffBaseline = runtime->guestExecutionHandoffEpochSnapshot();
-                }
-                if (steps >= kMaxIrqHandlerSteps)
-                {
-                    static uint32_t s_stepLimitLogCount = 0u;
-                    if (s_stepLimitLogCount < 16u)
-                    {
-                        std::cerr << "[INTC:step-limit] handler=0x" << std::hex << info.handler << " pc=0x" << irqCtx.pc << std::dec << std::endl;
-                        ++s_stepLimitLogCount;
-                    }
-                }
-                if (reschedulePending && !runtime->isStopRequested())
-                {
-                    runtime->waitForGuestExecutionHandoff(handoffBaseline);
-                }
-            }
-            catch (const ThreadExitException &)
-            {
-            }
-            catch (const std::exception &e)
-            {
-                static uint32_t warnCount = 0;
-                if (warnCount < 8u)
-                {
-                    std::cerr << "[INTC] handler 0x" << std::hex << info.handler
-                              << " threw exception: " << e.what() << std::dec << std::endl;
-                    ++warnCount;
-                }
-            }
+            setReturnS32(ctx,
+                         scheduler(rdram, ctx, runtime)
+                             .setIrqHandlerEnabled(dmac,
+                                                   static_cast<int>(getRegU32(ctx, 5)),
+                                                   enabled));
         }
     }
 
-    void dispatchDmacHandlersForCause(uint8_t *rdram, PS2Runtime *runtime, uint32_t cause)
+    void dispatchDmacHandlersForCause(uint8_t *, PS2Runtime *runtime, uint32_t cause)
     {
-        if (!rdram || !runtime)
-        {
-            return;
-        }
-
-        std::vector<IrqHandlerInfo> handlers;
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            if (cause < 32u && (g_enabled_dmac_mask & (1u << cause)) == 0u)
-            {
-                return;
-            }
-
-            handlers.reserve(g_dmacHandlers.size());
-            for (const auto &[id, info] : g_dmacHandlers)
-            {
-                (void)id;
-                if (!info.enabled)
-                {
-                    continue;
-                }
-                if (info.cause != cause)
-                {
-                    continue;
-                }
-                if (info.handler == 0u)
-                {
-                    continue;
-                }
-                handlers.push_back(info);
-            }
-            std::sort(handlers.begin(), handlers.end(), [](const IrqHandlerInfo &a, const IrqHandlerInfo &b)
-                      { return a.order < b.order; });
-        }
-
-        for (const IrqHandlerInfo &info : handlers)
-        {
-            if (!runtime->hasFunction(info.handler))
-            {
-                continue;
-            }
-
-            try
-            {
-                R5900Context irqCtx{};
-                SET_GPR_U32(&irqCtx, 28, info.gp);
-                SET_GPR_U32(&irqCtx, 29, getAsyncHandlerStackTop(runtime));
-                SET_GPR_U32(&irqCtx, 31, 0u);
-                SET_GPR_U32(&irqCtx, 4, cause);
-                SET_GPR_U32(&irqCtx, 5, info.arg);
-                SET_GPR_U32(&irqCtx, 6, 0u);
-                SET_GPR_U32(&irqCtx, 7, 0u);
-                irqCtx.pc = info.handler;
-
-                bool reschedulePending = false;
-                uint64_t handoffBaseline = 0u;
-                uint32_t steps = 0u;
-                {
-                    PS2Runtime::GuestExecutionScope guestExecution(runtime);
-                    PS2Runtime::DeferredGuestYieldScope deferYield(reschedulePending);
-
-                    while (irqCtx.pc != 0u && runtime && !runtime->isStopRequested() &&
-                           steps < kMaxIrqHandlerSteps)
-                    {
-                        PS2Runtime::RecompiledFunction step = runtime->lookupFunction(irqCtx.pc);
-                        if (!step)
-                        {
-                            break;
-                        }
-                        step(rdram, &irqCtx, runtime);
-                        ++steps;
-                    }
-                    handoffBaseline = runtime->guestExecutionHandoffEpochSnapshot();
-                }
-                if (steps >= kMaxIrqHandlerSteps)
-                {
-                    static uint32_t s_stepLimitLogCount = 0u;
-                    if (s_stepLimitLogCount < 16u)
-                    {
-                        std::cerr << "[DMAC:step-limit] handler=0x" << std::hex << info.handler
-                                  << " pc=0x" << irqCtx.pc << std::dec << std::endl;
-                        ++s_stepLimitLogCount;
-                    }
-                }
-                if (reschedulePending && !runtime->isStopRequested())
-                {
-                    runtime->waitForGuestExecutionHandoff(handoffBaseline);
-                }
-            }
-            catch (const ThreadExitException &)
-            {
-            }
-            catch (const std::exception &e)
-            {
-                static uint32_t warnCount = 0;
-                if (warnCount < 8u)
-                {
-                    std::cerr << "[DMAC] handler 0x" << std::hex << info.handler
-                              << " threw exception: " << e.what() << std::dec << std::endl;
-                    ++warnCount;
-                }
-            }
-        }
+        runtime->eeScheduler().dispatchIrq(true, cause);
     }
 
-    static void updateGsCsrFieldForVSync(PS2Runtime *runtime, uint64_t tickValue)
+    uint64_t GetCurrentVSyncTick(PS2Runtime *runtime)
     {
-        if (!runtime)
-        {
-            return;
-        }
-
-        constexpr uint64_t kGsCsrFieldMask = 0x2000ull;
-        std::atomic<uint64_t> &csr = runtime->memory().gs().csr;
-        if (tickValue & 1ull)
-        {
-            csr.fetch_or(kGsCsrFieldMask);
-        }
-        else
-        {
-            csr.fetch_and(~kGsCsrFieldMask);
-        }
+        return runtime->eeScheduler().currentVSyncTick();
     }
 
-    static uint64_t signalVSyncFlag(uint8_t *rdram, PS2Runtime *runtime)
+    void WaitVSyncTick(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime, int fixedResult)
     {
-        VSyncFlagRegistration reg{};
-        uint64_t tickValue = 0u;
-        {
-            std::lock_guard<std::mutex> lock(g_vsync_flag_mutex);
-            reg = g_vsync_registration;
-            g_vsync_registration = {};
-            tickValue = ++g_vsync_tick_counter;
-        }
-
-        g_vsync_cv.notify_all();
-        updateGsCsrFieldForVSync(runtime, tickValue);
-
-        if (reg.flagAddr != 0u)
-        {
-            writeGuestU32NoThrow(rdram, reg.flagAddr, 1u);
-        }
-        if (reg.tickAddr != 0u)
-        {
-            writeGuestU64NoThrow(rdram, reg.tickAddr, tickValue);
-        }
-        return tickValue;
-    }
-
-    static void interruptWorkerMain(uint8_t *rdram, PS2Runtime *runtime)
-    {
-        g_currentThreadId = -1;
-
-        using clock = std::chrono::steady_clock;
-        auto nextTick = clock::now() + kVblankPeriod;
-
-        while (runtime != nullptr && !runtime->isStopRequested())
-        {
-            {
-                std::unique_lock<std::mutex> lock(g_irq_worker_mutex);
-                if (g_irq_worker_cv.wait_until(lock, nextTick, []()
-                                               { return g_irq_worker_stop.load(std::memory_order_acquire); }))
-                {
-                    break;
-                }
-            }
-
-            const auto now = clock::now();
-            int ticksToProcess = 0;
-            while (now >= nextTick && ticksToProcess < kMaxCatchupTicks)
-            {
-                ++ticksToProcess;
-                nextTick += kVblankPeriod;
-            }
-            if (ticksToProcess == 0)
-            {
-                continue;
-            }
-
-            for (int i = 0; i < ticksToProcess; ++i)
-            {
-                bool reschedulePending = false;
-                uint64_t handoffBaseline = 0u;
-                {
-                    PS2Runtime::GuestExecutionScope guestExecution(runtime);
-                    PS2Runtime::DeferredGuestYieldScope deferYield(reschedulePending);
-                    const uint64_t tickValue = signalVSyncFlag(rdram, runtime);
-                    ps2_stubs::dispatchGsSyncVCallback(rdram, runtime, tickValue);
-                    dispatchIntcHandlersForCause(rdram, runtime, kIntcVblankStart);
-                    handoffBaseline = runtime->guestExecutionHandoffEpochSnapshot();
-                }
-                if (reschedulePending && !runtime->isStopRequested())
-                {
-                    runtime->waitForGuestExecutionHandoff(handoffBaseline);
-                }
-                std::this_thread::sleep_for(std::chrono::microseconds(500));
-                dispatchIntcHandlersForCause(rdram, runtime, kIntcVblankEnd);
-            }
-        }
-
-        g_irq_worker_running.store(false, std::memory_order_release);
-        g_irq_worker_cv.notify_all();
-    }
-
-    static void ensureInterruptWorkerRunning(uint8_t *rdram, PS2Runtime *runtime)
-    {
-        if (!rdram || !runtime)
-        {
-            return;
-        }
-
-        std::lock_guard<std::mutex> lock(g_irq_worker_mutex);
-        if (g_irq_worker_running.load(std::memory_order_acquire))
-        {
-            return;
-        }
-
-        g_irq_worker_stop.store(false, std::memory_order_release);
-        g_irq_worker_running.store(true, std::memory_order_release);
-        try
-        {
-            std::thread(interruptWorkerMain, rdram, runtime).detach();
-        }
-        catch (...)
-        {
-            g_irq_worker_running.store(false, std::memory_order_release);
-        }
-    }
-
-    void EnsureVSyncWorkerRunning(uint8_t *rdram, PS2Runtime *runtime)
-    {
-        ensureInterruptWorkerRunning(rdram, runtime);
-    }
-
-    uint64_t GetCurrentVSyncTick()
-    {
-        std::lock_guard<std::mutex> lock(g_vsync_flag_mutex);
-        return g_vsync_tick_counter;
-    }
-
-    void stopInterruptWorker()
-    {
-        g_irq_worker_stop.store(true, std::memory_order_release);
-        g_irq_worker_cv.notify_all();
-        std::unique_lock<std::mutex> lock(g_irq_worker_mutex);
-        g_irq_worker_cv.wait_for(lock, std::chrono::milliseconds(500), []()
-                                 { return !g_irq_worker_running.load(std::memory_order_acquire); });
-        g_vsync_cv.notify_all();
-    }
-
-    uint64_t WaitForNextVSyncTick(uint8_t *rdram, PS2Runtime *runtime)
-    {
-        ensureInterruptWorkerRunning(rdram, runtime);
-        std::unique_lock<std::mutex> lock(g_vsync_flag_mutex);
-        uint64_t current = g_vsync_tick_counter;
-        uint64_t result = current;
-        waitWithGuestExecutionReleasedUntilUnlocked(
-            runtime,
-            lock,
-            [&]()
-            {
-                g_vsync_cv.wait(lock, [current, runtime]()
-                                { return g_vsync_tick_counter > current || (runtime != nullptr && runtime->isStopRequested()); });
-            },
-            [&]()
-            {
-                result = g_vsync_tick_counter;
-            });
-        return result;
-    }
-
-    void WaitVSyncTick(uint8_t *rdram, PS2Runtime *runtime)
-    {
-        (void)WaitForNextVSyncTick(rdram, runtime);
+        EeScheduler &ee = scheduler(rdram, ctx, runtime);
+        ee.waitVSync(ee.currentVSyncTick(), fixedResult);
     }
 
     void SetVSyncFlag(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        const uint32_t flagAddr = getRegU32(ctx, 4);
-        const uint32_t tickAddr = getRegU32(ctx, 5);
-
+        const uint32_t flagAddress = getRegU32(ctx, 4);
+        const uint32_t tickAddress = getRegU32(ctx, 5);
+        if ((flagAddress != 0u && !getEeGuestStruct<uint32_t>(rdram, flagAddress)) ||
+            (tickAddress != 0u && !getEeGuestStruct<uint64_t>(rdram, tickAddress)))
         {
-            std::lock_guard<std::mutex> lock(g_vsync_flag_mutex);
-            g_vsync_registration.flagAddr = flagAddr;
-            g_vsync_registration.tickAddr = tickAddr;
+            setReturnS32(ctx, KE_ERROR);
+            return;
         }
-
-        writeGuestU32NoThrow(rdram, flagAddr, 0u);
-        writeGuestU64NoThrow(rdram, tickAddr, 0u);
-        ensureInterruptWorkerRunning(rdram, runtime);
+        scheduler(rdram, ctx, runtime).setVSyncFlag(flagAddress, tickAddress);
         setReturnS32(ctx, KE_OK);
     }
 
     void EnableIntc(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        const uint32_t cause = getRegU32(ctx, 4);
-        if (cause < 32u)
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            g_enabled_intc_mask |= (1u << cause);
-        }
-        if (cause == kIntcVblankStart || cause == kIntcVblankEnd)
-        {
-            PS2_IF_AGRESSIVE_LOGS({
-                static std::atomic<uint32_t> s_enableLogCount{0u};
-                const uint32_t logIndex = s_enableLogCount.fetch_add(1u, std::memory_order_relaxed);
-                if (logIndex < 32u)
-                {
-                    RUNTIME_LOG("[EnableIntc] cause=" << cause);
-                }
-            });
-        }
-        setReturnS32(ctx, KE_OK);
+        setCauseEnabled(rdram, ctx, runtime, false, true);
     }
 
     void iEnableIntc(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
@@ -542,24 +107,7 @@ namespace ps2_syscalls
 
     void DisableIntc(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        const uint32_t cause = getRegU32(ctx, 4);
-        if (cause < 32u)
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            g_enabled_intc_mask &= ~(1u << cause);
-        }
-        if (cause == kIntcVblankStart || cause == kIntcVblankEnd)
-        {
-            PS2_IF_AGRESSIVE_LOGS({
-                static std::atomic<uint32_t> s_disableLogCount{0u};
-                const uint32_t logIndex = s_disableLogCount.fetch_add(1u, std::memory_order_relaxed);
-                if (logIndex < 32u)
-                {
-                    RUNTIME_LOG("[DisableIntc] cause=" << cause);
-                }
-            });
-        }
-        setReturnS32(ctx, KE_OK);
+        setCauseEnabled(rdram, ctx, runtime, false, false);
     }
 
     void iDisableIntc(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
@@ -569,47 +117,7 @@ namespace ps2_syscalls
 
     void AddIntcHandler(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        IrqHandlerInfo info{};
-        info.cause = getRegU32(ctx, 4);
-        info.handler = getRegU32(ctx, 5);
-        uint32_t next = getRegU32(ctx, 6);
-        info.arg = getRegU32(ctx, 7);
-        info.gp = getRegU32(ctx, 28);
-        info.sp = getRegU32(ctx, 29);
-        info.enabled = true;
-
-        int handlerId = 0;
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            info.order = (next == 0) ? --g_intc_head_order : ++g_intc_tail_order;
-            handlerId = g_nextIntcHandlerId++;
-            info.id = handlerId;
-            g_intcHandlers[handlerId] = info;
-        }
-
-        if (info.cause == kIntcVblankStart)
-        {
-            PS2_IF_AGRESSIVE_LOGS({
-                static std::atomic<uint32_t> s_addHandlerLogCount{0u};
-                const uint32_t logIndex = s_addHandlerLogCount.fetch_add(1u, std::memory_order_relaxed);
-                if (logIndex < 32u)
-                {
-                    auto flags = std::cout.flags();
-                    std::cout << "[AddIntcHandler] cause=" << info.cause
-                              << " handler=0x" << std::hex << info.handler
-                              << " arg=0x" << info.arg
-                              << " gp=0x" << info.gp
-                              << " sp=0x" << info.sp
-                              << std::dec
-                              << " id=" << handlerId
-                              << std::endl;
-                    std::cout.flags(flags);
-                }
-            });
-        }
-
-        ensureInterruptWorkerRunning(rdram, runtime);
-        setReturnS32(ctx, handlerId);
+        addHandler(rdram, ctx, runtime, false);
     }
 
     void AddIntcHandler2(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
@@ -619,40 +127,12 @@ namespace ps2_syscalls
 
     void RemoveIntcHandler(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        const uint32_t cause = getRegU32(ctx, 4);
-        const int handlerId = static_cast<int>(getRegU32(ctx, 5));
-        if (handlerId > 0)
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            auto it = g_intcHandlers.find(handlerId);
-            if (it != g_intcHandlers.end() && it->second.cause == cause)
-            {
-                g_intcHandlers.erase(it);
-            }
-        }
-        setReturnS32(ctx, KE_OK);
+        removeHandler(rdram, ctx, runtime, false);
     }
 
     void AddDmacHandler(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        IrqHandlerInfo info{};
-        info.cause = getRegU32(ctx, 4);
-        info.handler = getRegU32(ctx, 5);
-        uint32_t next = getRegU32(ctx, 6);
-        info.arg = getRegU32(ctx, 7);
-        info.gp = getRegU32(ctx, 28);
-        info.sp = getRegU32(ctx, 29);
-        info.enabled = true;
-
-        int handlerId = 0;
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            info.order = (next == 0) ? --g_dmac_head_order : ++g_dmac_tail_order;
-            handlerId = g_nextDmacHandlerId++;
-            info.id = handlerId;
-            g_dmacHandlers[handlerId] = info;
-        }
-        setReturnS32(ctx, handlerId);
+        addHandler(rdram, ctx, runtime, true);
     }
 
     void AddDmacHandler2(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
@@ -662,81 +142,32 @@ namespace ps2_syscalls
 
     void RemoveDmacHandler(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        const uint32_t cause = getRegU32(ctx, 4);
-        const int handlerId = static_cast<int>(getRegU32(ctx, 5));
-        if (handlerId > 0)
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            auto it = g_dmacHandlers.find(handlerId);
-            if (it != g_dmacHandlers.end() && it->second.cause == cause)
-            {
-                g_dmacHandlers.erase(it);
-            }
-        }
-        setReturnS32(ctx, KE_OK);
+        removeHandler(rdram, ctx, runtime, true);
     }
 
     void EnableIntcHandler(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        const int handlerId = static_cast<int>(getRegU32(ctx, 5));
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            if (auto it = g_intcHandlers.find(handlerId); it != g_intcHandlers.end())
-            {
-                it->second.enabled = true;
-            }
-        }
-        setReturnS32(ctx, KE_OK);
+        setHandlerEnabled(rdram, ctx, runtime, false, true);
     }
 
     void DisableIntcHandler(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        const int handlerId = static_cast<int>(getRegU32(ctx, 5));
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            if (auto it = g_intcHandlers.find(handlerId); it != g_intcHandlers.end())
-            {
-                it->second.enabled = false;
-            }
-        }
-        setReturnS32(ctx, KE_OK);
+        setHandlerEnabled(rdram, ctx, runtime, false, false);
     }
 
     void EnableDmacHandler(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        const int handlerId = static_cast<int>(getRegU32(ctx, 5));
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            if (auto it = g_dmacHandlers.find(handlerId); it != g_dmacHandlers.end())
-            {
-                it->second.enabled = true;
-            }
-        }
-        setReturnS32(ctx, KE_OK);
+        setHandlerEnabled(rdram, ctx, runtime, true, true);
     }
 
     void DisableDmacHandler(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        const int handlerId = static_cast<int>(getRegU32(ctx, 5));
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            if (auto it = g_dmacHandlers.find(handlerId); it != g_dmacHandlers.end())
-            {
-                it->second.enabled = false;
-            }
-        }
-        setReturnS32(ctx, KE_OK);
+        setHandlerEnabled(rdram, ctx, runtime, true, false);
     }
 
     void EnableDmac(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        const uint32_t cause = getRegU32(ctx, 4);
-        if (cause < 32u)
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            g_enabled_dmac_mask |= (1u << cause);
-        }
-        setReturnS32(ctx, KE_OK);
+        setCauseEnabled(rdram, ctx, runtime, true, true);
     }
 
     void iEnableDmac(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
@@ -746,13 +177,7 @@ namespace ps2_syscalls
 
     void DisableDmac(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        const uint32_t cause = getRegU32(ctx, 4);
-        if (cause < 32u)
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            g_enabled_dmac_mask &= ~(1u << cause);
-        }
-        setReturnS32(ctx, KE_OK);
+        setCauseEnabled(rdram, ctx, runtime, true, false);
     }
 
     void iDisableDmac(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)

ps2xRuntime/src/lib/Kernel/Syscalls/Interrupt.h

@@ -1,37 +1,12 @@
 #pragma once
 
-#include <condition_variable>
 #include "ps2_syscalls.h"
 
 namespace ps2_syscalls
 {
-    namespace interrupt_state
-    {
-        struct VSyncFlagRegistration
-        {
-            uint32_t flagAddr;
-            uint32_t tickAddr;
-        };
-
-        extern std::mutex g_irq_handler_mutex;
-        extern std::mutex g_irq_worker_mutex;
-        extern std::condition_variable g_irq_worker_cv;
-        extern std::mutex g_vsync_flag_mutex;
-        extern std::condition_variable g_vsync_cv;
-        extern std::atomic<bool> g_irq_worker_stop;
-        extern std::atomic<bool> g_irq_worker_running;
-        extern uint32_t g_enabled_intc_mask;
-        extern uint32_t g_enabled_dmac_mask;
-        extern uint64_t g_vsync_tick_counter;
-        extern VSyncFlagRegistration g_vsync_registration;
-    }
-
     void dispatchDmacHandlersForCause(uint8_t *rdram, PS2Runtime *runtime, uint32_t cause);
-    void EnsureVSyncWorkerRunning(uint8_t *rdram, PS2Runtime *runtime);
-    uint64_t GetCurrentVSyncTick();
-    void stopInterruptWorker();
-    uint64_t WaitForNextVSyncTick(uint8_t *rdram, PS2Runtime *runtime);
-    void WaitVSyncTick(uint8_t *rdram, PS2Runtime *runtime);
+    uint64_t GetCurrentVSyncTick(PS2Runtime *runtime);
+    void WaitVSyncTick(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime, int fixedResult);
     void SetVSyncFlag(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);
     void EnableIntc(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);
     void iEnableIntc(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);

ps2xRuntime/src/lib/Kernel/Syscalls/Lifecycle.cpp

@@ -1,116 +0,0 @@
-#include "Common.h"
-#include "Interrupt.h"
-#include "Lifecycle.h"
-
-namespace ps2_syscalls
-{
-    using namespace interrupt_state;
-
-    void notifyRuntimeStop()
-    {
-        stopInterruptWorker();
-        {
-            std::lock_guard<std::mutex> lock(g_irq_handler_mutex);
-            g_intcHandlers.clear();
-            g_dmacHandlers.clear();
-            g_nextIntcHandlerId = 1;
-            g_nextDmacHandlerId = 1;
-            g_enabled_intc_mask = 0xFFFFFFFFu;
-            g_enabled_dmac_mask = 0xFFFFFFFFu;
-        }
-        {
-            std::lock_guard<std::mutex> lock(g_vsync_flag_mutex);
-            g_vsync_registration = {};
-            g_vsync_tick_counter = 0u;
-        }
-
-        std::vector<std::shared_ptr<ThreadInfo>> threads;
-        threads.reserve(32);
-        {
-            std::lock_guard<std::mutex> lock(g_thread_map_mutex);
-            for (const auto &entry : g_threads)
-            {
-                if (entry.second)
-                {
-                    threads.push_back(entry.second);
-                }
-            }
-            g_threads.clear();
-            g_nextThreadId = 2; // Reserve id 1 for main thread.
-        }
-        g_currentThreadId = 1;
-
-        for (const auto &threadInfo : threads)
-        {
-            {
-                std::lock_guard<std::mutex> lock(threadInfo->m);
-                threadInfo->forceRelease = true;
-                threadInfo->terminated = true;
-            }
-            threadInfo->cv.notify_all();
-        }
-
-        std::vector<std::shared_ptr<SemaInfo>> semas;
-        {
-            std::lock_guard<std::mutex> lock(g_sema_map_mutex);
-            semas.reserve(g_semas.size());
-            for (const auto &entry : g_semas)
-            {
-                if (entry.second)
-                {
-                    semas.push_back(entry.second);
-                }
-            }
-            g_semas.clear();
-            g_nextSemaId = 1;
-        }
-        for (const auto &sema : semas)
-        {
-            sema->cv.notify_all();
-        }
-
-        std::vector<std::shared_ptr<EventFlagInfo>> eventFlags;
-        {
-            std::lock_guard<std::mutex> lock(g_event_flag_map_mutex);
-            eventFlags.reserve(g_eventFlags.size());
-            for (const auto &entry : g_eventFlags)
-            {
-                if (entry.second)
-                {
-                    eventFlags.push_back(entry.second);
-                }
-            }
-            g_eventFlags.clear();
-            g_nextEventFlagId = 1;
-        }
-        for (const auto &eventFlag : eventFlags)
-        {
-            eventFlag->cv.notify_all();
-        }
-
-        {
-            std::lock_guard<std::mutex> lock(g_alarm_mutex);
-            g_alarms.clear();
-        }
-        g_alarm_cv.notify_all();
-
-        {
-            std::lock_guard<std::mutex> lock(g_exit_handler_mutex);
-            g_exit_handlers.clear();
-        }
-        {
-            std::lock_guard<std::mutex> lock(g_syscall_override_mutex);
-            g_syscall_overrides.clear();
-        }
-    }
-
-    void joinAllGuestHostThreads()
-    {
-        joinAllHostThreads();
-    }
-
-    void detachAllGuestHostThreads()
-    {
-        detachAllHostThreads();
-    }
-}

ps2xRuntime/src/lib/Kernel/Syscalls/Lifecycle.h

@@ -1,10 +0,0 @@
-#pragma once
-
-#include "ps2_syscalls.h"
-
-namespace ps2_syscalls
-{
-    void notifyRuntimeStop();
-    void joinAllGuestHostThreads();
-    void detachAllGuestHostThreads();
-}

ps2xRuntime/src/lib/Kernel/Syscalls/RPC.cpp

@@ -6,13 +6,13 @@ namespace ps2_syscalls
 {
     namespace
     {
-        SifRpcDebugEvent makeRpcDebugEvent(const char *op, R5900Context *ctx)
+        SifRpcDebugEvent makeRpcDebugEvent(const char *op, R5900Context *ctx, PS2Runtime *runtime)
         {
             SifRpcDebugEvent event{};
             event.op = op;
             event.pc = ctx ? ctx->pc : 0u;
             event.ra = ctx ? getRegU32(ctx, 31) : 0u;
-            event.threadId = static_cast<uint32_t>(g_currentThreadId);
+            event.threadId = runtime ? static_cast<uint32_t>(runtime->eeScheduler().currentThreadId()) : 0u;
             return event;
         }
 
@@ -139,34 +139,13 @@ namespace ps2_syscalls
         }
 #endif
 
-        bool signalRpcCompletionSema(uint32_t semaId)
+        bool signalRpcCompletionSema(PS2Runtime *runtime, uint32_t semaId)
         {
-            if (semaId == 0u || semaId > 0xFFFFu)
+            if (!runtime || semaId == 0u || semaId > 0xFFFFu)
             {
                 return false;
             }
-
-            auto sema = lookupSemaInfo(static_cast<int>(semaId));
-            if (!sema)
-            {
-                return false;
-            }
-
-            bool signaled = false;
-            {
-                std::lock_guard<std::mutex> lock(sema->m);
-                if (!sema->deleted && sema->count < sema->maxCount)
-                {
-                    sema->count++;
-                    signaled = true;
-                }
-            }
-
-            if (signaled)
-            {
-                sema->cv.notify_one();
-            }
-            return signaled;
+            return runtime->eeScheduler().signalSemaphore(static_cast<int>(semaId), true) >= 0;
         }
 
     } // namespace
@@ -261,7 +240,7 @@ namespace ps2_syscalls
             RUNTIME_LOG("[SifInitRpc] Initialized");
         }
 
-        SifRpcDebugEvent event = makeRpcDebugEvent("InitRpc", ctx);
+        SifRpcDebugEvent event = makeRpcDebugEvent("InitRpc", ctx, runtime);
         event.result = 0;
         pushSifRpcDebugEventLocked(event);
         setReturnS32(ctx, 0);
@@ -277,7 +256,7 @@ namespace ps2_syscalls
 
         if (!client)
         {
-            SifRpcDebugEvent event = makeRpcDebugEvent("BindRpc", ctx);
+            SifRpcDebugEvent event = makeRpcDebugEvent("BindRpc", ctx, runtime);
             event.clientPtr = clientPtr;
             event.sid = rpcId;
             event.mode = mode;
@@ -342,7 +321,7 @@ namespace ps2_syscalls
             client->cbuf = 0;
         }
 
-        SifRpcDebugEvent event = makeRpcDebugEvent("BindRpc", ctx);
+        SifRpcDebugEvent event = makeRpcDebugEvent("BindRpc", ctx, runtime);
         event.clientPtr = clientPtr;
         event.serverPtr = serverPtr;
         event.sid = rpcId;
@@ -473,7 +452,7 @@ namespace ps2_syscalls
         auto *client = reinterpret_cast<t_SifRpcClientData *>(getMemPtr(rdram, clientPtr));
         if (!client)
         {
-            SifRpcDebugEvent event = makeRpcDebugEvent("CallRpc", ctx);
+            SifRpcDebugEvent event = makeRpcDebugEvent("CallRpc", ctx, runtime);
             event.clientPtr = clientPtr;
             event.sid = sidHint;
             event.rpcNum = rpcNum;
@@ -535,24 +514,12 @@ namespace ps2_syscalls
             }
         }
 
-        uint32_t resultPointer = 0u;
-        bool handled = false;
-        bool handledByIop = false;
-        bool serverDispatched = false;
-        bool callbackCompleted = false;
-        bool copiedFallback = false;
-        bool zeroedFallback = false;
         ps2x::iop::RpcResult iopResult{};
-
-        const auto completionSemaphore = [&]()
+        uint32_t completionSemaphore = static_cast<uint32_t>(client->hdr.sema_id);
+        if (completionSemaphore == 0xFFFFFFFFu || completionSemaphore == 0u)
         {
-            uint32_t semaphore = static_cast<uint32_t>(client->hdr.sema_id);
-            if (semaphore == 0xFFFFFFFFu || semaphore == 0u)
-            {
-                semaphore = endParameter;
-            }
-            return semaphore;
-        };
+            completionSemaphore = endParameter;
+        }
 
         {
             ps2x::iop::RpcRequest request{};
@@ -569,171 +536,162 @@ namespace ps2_syscalls
             request.endParameter = endParameter;
 
             iopResult = PS2IopTransport::handleRpc(runtime, rdram, ctx, request);
-            handled = iopResult.handled;
-            handledByIop = iopResult.handled;
-            resultPointer = iopResult.resultAddress;
 
             if (iopResult.signalNowaitCompletion &&
                 (mode & kSifRpcModeNowait) != 0u)
             {
-                (void)signalRpcCompletionSema(completionSemaphore());
+                (void)signalRpcCompletionSema(runtime, completionSemaphore);
             }
             if (iopResult.signalCompletion)
             {
-                (void)signalRpcCompletionSema(completionSemaphore());
+                (void)signalRpcCompletionSema(runtime, completionSemaphore);
             }
         }
 
-        if (server && server->func != 0u && iopResult.serverDispatchPolicy != ps2x::iop::ServerDispatchPolicy::Suppress)
+        uint32_t guestFunction = iopResult.guestFunction;
+        uint32_t guestA0 = iopResult.guestArguments[0];
+        uint32_t guestA1 = iopResult.guestArguments[1];
+        uint32_t guestA2 = iopResult.guestArguments[2];
+        uint32_t guestA3 = iopResult.guestArguments[3];
+        uint32_t guestDefaultResult = iopResult.guestDefaultResultAddress;
+        if (guestFunction == 0u && server && server->func != 0u &&
+            iopResult.serverDispatchPolicy != ps2x::iop::ServerDispatchPolicy::Suppress)
         {
-            uint32_t serverResult = 0u;
-            serverDispatched = rpcInvokeFunction(rdram,
-                                                 ctx,
-                                                 runtime,
-                                                 server->func,
-                                                 rpcNum,
-                                                 server->buf,
-                                                 sendSize,
-                                                 0u,
-                                                 &serverResult);
-            if (serverDispatched)
+            guestFunction = server->func;
+            guestA0 = rpcNum;
+            guestA1 = server->buf;
+            guestA2 = sendSize;
+            guestDefaultResult = server->buf != 0u ? server->buf : receiveBuffer;
+        }
+        const bool serverDispatched = guestFunction != 0u && runtime->hasFunction(guestFunction);
+
+        auto finishCall = [=](const R5900Context *guestResult, R5900Context &parent)
+        {
+            bool handled = iopResult.handled;
+            uint32_t resultPointer = iopResult.resultAddress;
+            bool copiedFallback = false;
+            bool zeroedFallback = false;
+            if (guestResult)
             {
                 handled = true;
-                resultPointer = serverResult;
-                if (resultPointer == 0u && server->buf != 0u)
-                {
-                    resultPointer = server->buf;
-                }
+                resultPointer = getRegU32(guestResult, 2);
                 if (resultPointer == 0u)
                 {
-                    resultPointer = receiveBuffer;
+                    resultPointer = guestDefaultResult;
                 }
             }
-        }
 
-        if (receiveBuffer != 0u && receiveSize != 0u)
-        {
-            if (handled && resultPointer != 0u && resultPointer != receiveBuffer)
+            if (receiveBuffer != 0u && receiveSize != 0u)
             {
-                rpcCopyToRdram(rdram,
-                               receiveBuffer,
-                               resultPointer,
-                               receiveSize);
-            }
-            else if (!handled && sendBuf != 0u && sendSize != 0u && sendBuf != receiveBuffer)
-            {
-                const uint32_t copySize = std::min(sendSize, receiveSize);
-                rpcCopyToRdram(rdram, receiveBuffer, sendBuf, copySize);
-                copiedFallback = true;
-            }
-            else if (!handled)
-            {
-                rpcZeroRdram(rdram, receiveBuffer, receiveSize);
-                zeroedFallback = true;
-            }
-        }
-
-        if (endFunction != 0u)
-        {
-            if (iopResult.callbackPolicy == ps2x::iop::CallbackPolicy::Suppress)
-            {
-                callbackCompleted = true;
-            }
-            else
-            {
-                callbackCompleted = rpcInvokeFunction(rdram,
-                                                      ctx,
-                                                      runtime,
-                                                      endFunction,
-                                                      endParameter,
-                                                      0u,
-                                                      0u,
-                                                      0u,
-                                                      nullptr);
-                if (!callbackCompleted && endFunction >= 0x10000u)
+                if (handled && resultPointer != 0u && resultPointer != receiveBuffer)
                 {
-                    const uint32_t normalizedEndFunction = endFunction - 0x10000u;
-                    if (runtime->hasFunction(normalizedEndFunction))
-                    {
-                        callbackCompleted = rpcInvokeFunction(
-                            rdram,
-                            ctx,
-                            runtime,
-                            normalizedEndFunction,
-                            endParameter,
-                            0u,
-                            0u,
-                            0u,
-                            nullptr);
-                    }
+                    rpcCopyToRdram(rdram, receiveBuffer, resultPointer, receiveSize);
                 }
-            }
-
-            if (!callbackCompleted)
-            {
-                const bool signaled = signalRpcCompletionSema(completionSemaphore());
-                static uint32_t unresolvedCallbackWarnings = 0u;
-                if (unresolvedCallbackWarnings < 32u)
+                else if (!handled && sendBuf != 0u && sendSize != 0u && sendBuf != receiveBuffer)
                 {
-                    std::cerr
-                        << "[SifCallRpc] unresolved end callback endFunc=0x"
-                        << std::hex << endFunction
-                        << " semaId=0x" << completionSemaphore()
-                        << " fallbackSignal=" << std::dec
-                        << (signaled ? 1 : 0) << std::endl;
-                    ++unresolvedCallbackWarnings;
+                    rpcCopyToRdram(rdram, receiveBuffer, sendBuf, std::min(sendSize, receiveSize));
+                    copiedFallback = true;
+                }
+                else if (!handled)
+                {
+                    rpcZeroRdram(rdram, receiveBuffer, receiveSize);
+                    zeroedFallback = true;
                 }
             }
-        }
-
-        {
-            std::lock_guard<std::mutex> lock(g_rpc_mutex);
-            g_rpc_clients[clientPtr].busy = false;
-        }
-
-        SifRpcDebugEvent event = makeRpcDebugEvent("CallRpc", ctx);
-        event.clientPtr = clientPtr;
-        event.serverPtr = serverPtr;
-        event.sid = sid;
-        event.rpcNum = rpcNum;
-        event.mode = mode;
-        event.sendBuf = sendBuf;
-        event.sendSize = sendSize;
-        event.recvBuf = receiveBuffer;
-        event.recvSize = receiveSize;
-        event.resultPtr = resultPointer;
-        event.endFunc = endFunction;
-        event.endParam = endParameter;
-        event.semaId = static_cast<uint32_t>(client->hdr.sema_id);
-        event.flags =
-            ((mode & kSifRpcModeNowait) ? kSifRpcDebugFlagNowait : 0u) |
-            (handledByIop ? kSifRpcDebugFlagHandledByHle : 0u) |
-            (callbackCompleted ? kSifRpcDebugFlagCallback : 0u) |
-            (serverDispatched ? kSifRpcDebugFlagServerDispatch : 0u) |
-            (!handled ? kSifRpcDebugFlagUnhandled : 0u) |
-            (copiedFallback ? kSifRpcDebugFlagFallbackCopy : 0u) |
-            (zeroedFallback ? kSifRpcDebugFlagFallbackZero : 0u);
-        fillRpcDebugPreview(rdram,
-                            sendBuf,
-                            sendSize,
-                            event.sendPreview,
-                            event.sendPreviewSize);
-        fillRpcDebugPreview(rdram,
-                            receiveBuffer,
-                            receiveSize,
-                            event.recvPreview,
-                            event.recvPreviewSize);
-        event.result = 0;
 
+            auto completeClient = [=](R5900Context &base, bool callbackCompleted)
+            {
+                {
+                    std::lock_guard<std::mutex> lock(g_rpc_mutex);
+                    g_rpc_clients[clientPtr].busy = false;
+                }
+                SifRpcDebugEvent event = makeRpcDebugEvent("CallRpc", &base, runtime);
+                event.clientPtr = clientPtr;
+                event.serverPtr = serverPtr;
+                event.sid = sid;
+                event.rpcNum = rpcNum;
+                event.mode = mode;
+                event.sendBuf = sendBuf;
+                event.sendSize = sendSize;
+                event.recvBuf = receiveBuffer;
+                event.recvSize = receiveSize;
+                event.resultPtr = resultPointer;
+                event.endFunc = endFunction;
+                event.endParam = endParameter;
+                event.semaId = completionSemaphore;
+                event.flags =
+                    ((mode & kSifRpcModeNowait) ? kSifRpcDebugFlagNowait : 0u) |
+                    (iopResult.handled ? kSifRpcDebugFlagHandledByHle : 0u) |
+                    (callbackCompleted ? kSifRpcDebugFlagCallback : 0u) |
+                    (serverDispatched ? kSifRpcDebugFlagServerDispatch : 0u) |
+                    (!handled ? kSifRpcDebugFlagUnhandled : 0u) |
+                    (copiedFallback ? kSifRpcDebugFlagFallbackCopy : 0u) |
+                    (zeroedFallback ? kSifRpcDebugFlagFallbackZero : 0u);
+                fillRpcDebugPreview(rdram, sendBuf, sendSize, event.sendPreview, event.sendPreviewSize);
+                fillRpcDebugPreview(rdram, receiveBuffer, receiveSize, event.recvPreview, event.recvPreviewSize);
+                event.result = 0;
 #if PS2X_ENABLE_IOP_RPC_TRACE
-        if ((event.flags & kSifRpcDebugFlagUnhandled) != 0u)
-        {
-            logUnhandledRpcTrace(event);
-        }
+                if ((event.flags & kSifRpcDebugFlagUnhandled) != 0u)
+                {
+                    logUnhandledRpcTrace(event);
+                }
 #endif
-        pushSifRpcDebugEvent(event);
+                pushSifRpcDebugEvent(event);
+            };
 
-        setReturnS32(ctx, 0);
+            setReturnS32(&parent, 0);
+            if (endFunction == 0u || iopResult.callbackPolicy == ps2x::iop::CallbackPolicy::Suppress)
+            {
+                completeClient(parent, endFunction != 0u);
+                return;
+            }
+
+            uint32_t callbackFunction = endFunction;
+            if (!runtime->hasFunction(callbackFunction) && callbackFunction >= 0x10000u &&
+                runtime->hasFunction(callbackFunction - 0x10000u))
+            {
+                callbackFunction -= 0x10000u;
+            }
+            if (!runtime->hasFunction(callbackFunction))
+            {
+                (void)signalRpcCompletionSema(runtime, completionSemaphore);
+                completeClient(parent, false);
+                return;
+            }
+
+            GuestInvocation callback{};
+            callback.kind = GuestInvocationKind::RpcCallback;
+            callback.context = parent;
+            callback.context.pc = callbackFunction;
+            SET_GPR_U32(&callback.context, 4, endParameter);
+            SET_GPR_U32(&callback.context, 29, runtime->eeScheduler().invocationStackTop());
+            SET_GPR_U32(&callback.context, 31, 0u);
+            callback.onComplete = [completeClient](const R5900Context &, R5900Context &base)
+            {
+                completeClient(base, true);
+            };
+            runtime->eeScheduler().invokeCurrent(std::move(callback));
+        };
+
+        if (serverDispatched)
+        {
+            GuestInvocation invocation{};
+            invocation.kind = GuestInvocationKind::RpcCallback;
+            invocation.context = *ctx;
+            invocation.context.pc = guestFunction;
+            SET_GPR_U32(&invocation.context, 4, guestA0);
+            SET_GPR_U32(&invocation.context, 5, guestA1);
+            SET_GPR_U32(&invocation.context, 6, guestA2);
+            SET_GPR_U32(&invocation.context, 7, guestA3);
+            SET_GPR_U32(&invocation.context, 29, runtime->eeScheduler().invocationStackTop());
+            SET_GPR_U32(&invocation.context, 31, 0u);
+            invocation.onComplete = [finishCall](const R5900Context &completed, R5900Context &parent)
+            {
+                finishCall(&completed, parent);
+            };
+            runtime->eeScheduler().invokeCurrent(std::move(invocation));
+        }
+        finishCall(nullptr, *ctx);
     }
 
     void SifRegisterRpc(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
@@ -754,7 +712,7 @@ namespace ps2_syscalls
         t_SifRpcServerData *sd = reinterpret_cast<t_SifRpcServerData *>(getMemPtr(rdram, sdPtr));
         if (!sd)
         {
-            SifRpcDebugEvent event = makeRpcDebugEvent("RegisterRpc", ctx);
+            SifRpcDebugEvent event = makeRpcDebugEvent("RegisterRpc", ctx, runtime);
             event.serverPtr = sdPtr;
             event.sid = sid;
             event.sendBuf = buf;
@@ -836,7 +794,7 @@ namespace ps2_syscalls
         }
 
         RUNTIME_LOG("[SifRegisterRpc] sid=0x" << std::hex << sid << " sd=0x" << sdPtr << std::dec);
-        SifRpcDebugEvent event = makeRpcDebugEvent("RegisterRpc", ctx);
+        SifRpcDebugEvent event = makeRpcDebugEvent("RegisterRpc", ctx, runtime);
         event.serverPtr = sdPtr;
         event.sid = sid;
         event.sendBuf = buf;

ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp

@@ -405,145 +405,41 @@ namespace ps2_syscalls
         setReturnS32(ctx, 0);
     }
 
-    static uint32_t computeBuiltinFindAddressResult(uint8_t *rdram,
-                                                    uint32_t originalStart,
-                                                    uint32_t originalEnd,
-                                                    uint32_t target);
-
     bool dispatchSyscallOverride(uint32_t syscallNumber, uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         uint32_t handler = 0u;
-        {
-            std::lock_guard<std::mutex> lock(g_syscall_override_mutex);
-            auto it = g_syscall_overrides.find(syscallNumber);
-            if (it == g_syscall_overrides.end())
-            {
-                return false;
-            }
-            handler = it->second;
-        }
-
-        if (!runtime || !ctx || handler == 0u)
+        if (!runtime || !ctx ||
+            !runtime->findEeSyscallOverride(syscallNumber, handler) ||
+            handler == 0u)
         {
             return false;
         }
 
-        const uint32_t overrideA0 = getRegU32(ctx, 4);
-        const uint32_t overrideA1 = getRegU32(ctx, 5);
-        const uint32_t overrideA2 = getRegU32(ctx, 6);
-        const uint32_t overrideA3 = getRegU32(ctx, 7);
-        const uint32_t overridePc = ctx->pc;
-        const uint32_t overrideRa = getRegU32(ctx, 31);
-
-        thread_local std::vector<uint32_t> s_activeSyscallOverrides;
-        if (std::find(s_activeSyscallOverrides.begin(), s_activeSyscallOverrides.end(), syscallNumber) != s_activeSyscallOverrides.end())
+        EeScheduler &scheduler = runtime->eeScheduler();
+        scheduler.bindMainContextForSyscall(*ctx, rdram);
+        if (scheduler.hasInvocation(GuestInvocationKind::SyscallOverride, syscallNumber))
         {
-            static std::atomic<uint32_t> s_reentrantLogs{0u};
-            constexpr uint32_t kMaxReentrantLogs = 32u;
-            const uint32_t logIndex = s_reentrantLogs.fetch_add(1u, std::memory_order_relaxed);
-            if (logIndex < kMaxReentrantLogs)
-            {
-                PS2_IF_AGRESSIVE_LOGS({
-                    std::cerr << "[SyscallOverride:reentrant]"
-                              << " syscall=0x" << std::hex << syscallNumber
-                              << " handler=0x" << handler
-                              << " pc=0x" << ctx->pc
-                              << " ra=0x" << getRegU32(ctx, 31)
-                              << std::dec << std::endl;
-                });
-            }
             return false;
         }
 
-        s_activeSyscallOverrides.push_back(syscallNumber);
-        struct ScopedActiveOverride
+        if (!runtime->hasFunction(handler))
         {
-            std::vector<uint32_t> &active;
-            ~ScopedActiveOverride()
-            {
-                if (!active.empty())
-                {
-                    active.pop_back();
-                }
-            }
-        } scopedActiveOverride{s_activeSyscallOverrides};
-
-        uint32_t retV0 = 0u;
-        const bool invoked = rpcInvokeFunction(rdram,
-                                               ctx,
-                                               runtime,
-                                               handler,
-                                               getRegU32(ctx, 4),
-                                               getRegU32(ctx, 5),
-                                               getRegU32(ctx, 6),
-                                               getRegU32(ctx, 7),
-                                               &retV0);
-
-        if (syscallNumber == 0x83u)
-        {
-            const uint32_t builtinRet = computeBuiltinFindAddressResult(rdram, overrideA0, overrideA1, overrideA2);
-            const bool mismatch = (retV0 != builtinRet);
-
-            static std::atomic<uint32_t> s_findAddressOverrideLogs{0u};
-            static std::atomic<uint32_t> s_findAddressOverrideMismatchLogs{0u};
-            constexpr uint32_t kMaxFindAddressOverrideLogs = 64u;
-            constexpr uint32_t kMaxFindAddressOverrideMismatchLogs = 128u;
-
-            const uint32_t logIndex = s_findAddressOverrideLogs.fetch_add(1u, std::memory_order_relaxed);
-            const uint32_t mismatchIndex = mismatch
-                                               ? s_findAddressOverrideMismatchLogs.fetch_add(1u, std::memory_order_relaxed)
-                                               : 0u;
-            if (logIndex < kMaxFindAddressOverrideLogs ||
-                (mismatch && mismatchIndex < kMaxFindAddressOverrideMismatchLogs))
-            {
-                const uint32_t guestMinus20c = (retV0 != 0u) ? (retV0 - 0x20Cu) : 0u;
-                const uint32_t guestMinus168 = (retV0 != 0u) ? (retV0 - 0x168u) : 0u;
-                const uint32_t builtinMinus20c = (builtinRet != 0u) ? (builtinRet - 0x20Cu) : 0u;
-                const uint32_t builtinMinus168 = (builtinRet != 0u) ? (builtinRet - 0x168u) : 0u;
-
-                PS2_IF_AGRESSIVE_LOGS({
-                    std::cerr << "[Syscall83:override]"
-                              << " handler=0x" << std::hex << handler
-                              << " invoked=" << (invoked ? "true" : "false")
-                              << " pc=0x" << overridePc
-                              << " ra=0x" << overrideRa
-                              << " a0=0x" << overrideA0
-                              << " a1=0x" << overrideA1
-                              << " a2=0x" << overrideA2
-                              << " a3=0x" << overrideA3
-                              << " guestRet=0x" << retV0
-                              << " builtinRet=0x" << builtinRet
-                              << " guest-20c=0x" << guestMinus20c
-                              << " builtin-20c=0x" << builtinMinus20c
-                              << " guest-168=0x" << guestMinus168
-                              << " builtin-168=0x" << builtinMinus168
-                              << " match=" << (mismatch ? "false" : "true")
-                              << std::dec << std::endl;
-                });
-            }
+            setReturnS32(ctx, KE_ERROR);
+            return true;
         }
 
-        if (!invoked)
+        GuestInvocation invocation{};
+        invocation.kind = GuestInvocationKind::SyscallOverride;
+        invocation.tag = syscallNumber;
+        invocation.context = *ctx;
+        invocation.context.pc = handler;
+        SET_GPR_U32(&invocation.context, 29, scheduler.invocationStackTop());
+        SET_GPR_U32(&invocation.context, 31, 0u);
+        invocation.onComplete = [](const R5900Context &completed, R5900Context &parent)
         {
-            static std::atomic<uint32_t> s_fallbackLogs{0u};
-            constexpr uint32_t kMaxFallbackLogs = 64u;
-            const uint32_t logIndex = s_fallbackLogs.fetch_add(1u, std::memory_order_relaxed);
-            if (logIndex < kMaxFallbackLogs)
-            {
-                PS2_IF_AGRESSIVE_LOGS({
-                    std::cerr << "[SyscallOverride:fallback]"
-                              << " syscall=0x" << std::hex << syscallNumber
-                              << " handler=0x" << handler
-                              << " pc=0x" << ctx->pc
-                              << " ra=0x" << getRegU32(ctx, 31)
-                              << std::dec << std::endl;
-                });
-            }
-            return false;
-        }
-
-        setReturnU32(ctx, retV0);
-        return true;
+            parent.r[2] = completed.r[2];
+        };
+        scheduler.invokeCurrent(std::move(invocation));
     }
 
     static bool tryResolveGuestSyscallMirrorAddr(uint32_t syscallIndex, uint32_t &guestAddr)
@@ -573,73 +469,20 @@ namespace ps2_syscalls
         }
     }
 
-    static void seedGuestSyscallTableProbeLocked(uint8_t *rdram)
+    void initializeGuestKernelState(uint8_t *rdram, PS2Runtime *runtime)
     {
-        writeGuestKernelWord(rdram, kGuestSyscallTableProbeBase + 0u, kGuestSyscallTableGuestBase >> 16);
-        writeGuestKernelWord(rdram, kGuestSyscallTableProbeBase + 8u, kGuestSyscallTableGuestBase & 0xFFFFu);
-        g_syscall_mirror_addrs.insert(kGuestSyscallTableProbeBase + 0u);
-        g_syscall_mirror_addrs.insert(kGuestSyscallTableProbeBase + 8u);
-    }
-
-    static void mirrorGuestSyscallEntryLocked(uint8_t *rdram, uint32_t syscallIndex, uint32_t handler)
-    {
-        uint32_t guestAddr = 0u;
-        if (!tryResolveGuestSyscallMirrorAddr(syscallIndex, guestAddr))
+        if (!runtime)
         {
             return;
         }
-
-        writeGuestKernelWord(rdram, guestAddr, handler);
-        if (handler == 0u)
-        {
-            g_syscall_mirror_addrs.erase(guestAddr);
-            return;
-        }
-
-        g_syscall_mirror_addrs.insert(guestAddr);
-    }
-
-    void initializeGuestKernelState(uint8_t *rdram)
-    {
-        if (!rdram)
-        {
-            return;
-        }
-
-        std::lock_guard<std::mutex> lock(g_syscall_override_mutex);
-        for (uint32_t guestAddr : g_syscall_mirror_addrs)
-        {
-            writeGuestKernelWord(rdram, guestAddr, 0u);
-        }
-        g_syscall_mirror_addrs.clear();
-
-        seedGuestSyscallTableProbeLocked(rdram);
-
-        for (const auto &entry : g_syscall_overrides)
-        {
-            mirrorGuestSyscallEntryLocked(rdram, entry.first, entry.second);
-        }
+        runtime->initializeEeKernelState(rdram);
     }
 
     void SetSyscall(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        (void)runtime;
         const uint32_t syscallIndex = getRegU32(ctx, 4);
         const uint32_t handler = getRegU32(ctx, 5);
-
-        {
-            std::lock_guard<std::mutex> lock(g_syscall_override_mutex);
-            if (handler == 0u)
-            {
-                g_syscall_overrides.erase(syscallIndex);
-            }
-            else
-            {
-                g_syscall_overrides[syscallIndex] = handler;
-            }
-
-            mirrorGuestSyscallEntryLocked(rdram, syscallIndex, handler);
-        }
+        runtime->setEeSyscallOverride(rdram, syscallIndex, handler);
 
         setReturnS32(ctx, 0);
     }
@@ -1091,7 +934,9 @@ namespace ps2_syscalls
     // GetThreadTLS (stub): return 0
     void GetThreadTLS(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        auto info = ensureCurrentThreadInfo(ctx);
+        EeScheduler &ee = runtime->eeScheduler();
+        ee.bindMainContextForSyscall(*ctx, rdram);
+        GuestThread *info = ee.currentThread();
         if (!info)
         {
             setReturnU32(ctx, 0);
@@ -1149,11 +994,10 @@ namespace ps2_syscalls
             return;
         }
 
-        int tid = g_currentThreadId;
-        {
-            std::lock_guard<std::mutex> lock(g_exit_handler_mutex);
-            g_exit_handlers[tid].push_back({func, arg});
-        }
+        EeScheduler &ee = runtime->eeScheduler();
+        ee.bindMainContextForSyscall(*ctx, rdram);
+        const int tid = ee.currentThreadId();
+        runtime->addEeExitHandler(tid, func, arg);
 
         setReturnS32(ctx, 0);
     }

ps2xRuntime/src/lib/Kernel/Syscalls/System.h

@@ -23,7 +23,7 @@ namespace ps2_syscalls
     void sceSifLoadModule(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);
     void sceSifLoadModuleBuffer(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);
     void TODO(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime, uint32_t encodedSyscallId);
-    void initializeGuestKernelState(uint8_t *rdram);
+    void initializeGuestKernelState(uint8_t *rdram, PS2Runtime *runtime);
     void SetSyscall(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);
     void SetupThread(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);
     void SetupHeap(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime);

ps2xRuntime/src/lib/ps2_debug_panel.cpp

@@ -2,6 +2,7 @@
 #include "ps2_runtime.h"
 #include "ps2_runtime_macros.h"
 #include "ps2_log.h"
+#include "runtime/ee_scheduler.h"
 
 #include <unordered_set>
 #include "Kernel/Syscalls/Helpers/State.h"
@@ -32,39 +33,45 @@
 namespace
 {
 #if defined(PS2X_ENABLE_DEBUG_UI) && !defined(PLATFORM_VITA)
-    const char *threadStatusName(int status)
+    const char *threadStatusName(EeThreadStatus status)
     {
         switch (status)
         {
-        case THS_RUN:
+        case EeThreadStatus::Running:
             return "RUN";
-        case THS_READY:
+        case EeThreadStatus::Ready:
             return "READY";
-        case THS_WAIT:
+        case EeThreadStatus::Waiting:
             return "WAIT";
-        case THS_SUSPEND:
+        case EeThreadStatus::Suspended:
             return "SUSPEND";
-        case THS_WAITSUSPEND:
+        case EeThreadStatus::WaitingSuspended:
             return "WAITSUSP";
-        case THS_DORMANT:
+        case EeThreadStatus::Dormant:
             return "DORMANT";
         default:
             return "?";
         }
     }
 
-    const char *waitTypeName(int waitType)
+    const char *waitTypeName(EeWaitReason waitType)
     {
         switch (waitType)
         {
-        case TSW_NONE:
+        case EeWaitReason::None:
             return "NONE";
-        case TSW_SLEEP:
+        case EeWaitReason::Sleep:
             return "SLEEP";
-        case TSW_SEMA:
+        case EeWaitReason::Semaphore:
             return "SEMA";
-        case TSW_EVENT:
+        case EeWaitReason::EventFlag:
             return "EVENT";
+        case EeWaitReason::VSync:
+            return "VSYNC";
+        case EeWaitReason::External:
+            return "EXTERNAL";
+        case EeWaitReason::Mpeg:
+            return "MPEG";
         default:
             return "?";
         }
@@ -698,7 +705,7 @@ namespace
         const uint32_t gp = runtime.m_debugGp.load(std::memory_order_relaxed);
 
         ImGui::Text("Runtime: %s", runtime.isStopRequested() ? "stop requested" : "running");
-        ImGui::Text("Guest execution waiters: %u", runtime.guestExecutionWaiterCountForTesting());
+        ImGui::Text("EE executor: %s", runtime.eeScheduler().isExecutingGuest() ? "guest" : "scheduler");
         ImGui::Separator();
         textHex32("PC", pc);
         ImGui::SameLine();
@@ -756,60 +763,11 @@ namespace
         }
     }
 
-    void drawThreadsTab()
+    void drawThreadsTab(PS2Runtime &runtime)
     {
-        struct ThreadRow
-        {
-            int id = 0;
-            uint32_t entry = 0;
-            uint32_t stack = 0;
-            uint32_t stackSize = 0;
-            uint32_t gp = 0;
-            uint32_t priority = 0;
-            int status = 0;
-            int waitType = 0;
-            int waitId = 0;
-            int currentPriority = 0;
-            int wakeupCount = 0;
-            int suspendCount = 0;
-            uint32_t currentPc = 0u;
-            bool terminated = false;
-        };
-
-        std::vector<ThreadRow> rows;
-        {
-            std::lock_guard<std::mutex> lock(g_thread_map_mutex);
-            rows.reserve(g_threads.size());
-            for (const auto &[id, ptr] : g_threads)
-            {
-                if (!ptr)
-                {
-                    continue;
-                }
-                ThreadRow row{};
-                row.id = id;
-                {
-                    std::lock_guard<std::mutex> threadLock(ptr->m);
-                    row.entry = ptr->entry;
-                    row.stack = ptr->stack;
-                    row.stackSize = ptr->stackSize;
-                    row.gp = ptr->gp;
-                    row.priority = ptr->priority;
-                    row.currentPriority = ptr->currentPriority;
-                    row.status = ptr->status;
-                    row.waitType = ptr->waitType;
-                    row.waitId = ptr->waitId;
-                    row.wakeupCount = ptr->wakeupCount;
-                    row.suspendCount = ptr->suspendCount;
-                }
-                row.currentPc = ptr->currentPc.load(std::memory_order_relaxed);
-                row.terminated = ptr->terminated.load(std::memory_order_relaxed);
-                rows.push_back(row);
-            }
-        }
-
-        ImGui::Text("Threads: %zu activeThreads=%d", rows.size(), g_activeThreads.load(std::memory_order_relaxed));
-        if (ImGui::BeginTable("threads", 12, ImGuiTableFlags_Borders | ImGuiTableFlags_RowBg | ImGuiTableFlags_Resizable | ImGuiTableFlags_ScrollY, ImVec2(0, 320)))
+        const EeKernelSnapshot snapshot = runtime.eeScheduler().snapshot();
+        ImGui::Text("Threads: %zu running=%d", snapshot.threads.size(), snapshot.runningThreadId);
+        if (ImGui::BeginTable("threads", 11, ImGuiTableFlags_Borders | ImGuiTableFlags_RowBg | ImGuiTableFlags_Resizable | ImGuiTableFlags_ScrollY, ImVec2(0, 320)))
         {
             ImGui::TableSetupColumn("ID");
             ImGui::TableSetupColumn("Status");
@@ -822,9 +780,8 @@ namespace
             ImGui::TableSetupColumn("Prio");
             ImGui::TableSetupColumn("Wake");
             ImGui::TableSetupColumn("Susp");
-            ImGui::TableSetupColumn("Term");
             ImGui::TableHeadersRow();
-            for (const ThreadRow &row : rows)
+            for (const EeThreadSnapshot &row : snapshot.threads)
             {
                 ImGui::TableNextRow();
                 ImGui::TableNextColumn();
@@ -832,11 +789,11 @@ namespace
                 ImGui::TableNextColumn();
                 ImGui::Text("%s", threadStatusName(row.status));
                 ImGui::TableNextColumn();
-                ImGui::Text("%s", waitTypeName(row.waitType));
+                ImGui::Text("%s", waitTypeName(row.waitReason));
                 ImGui::TableNextColumn();
                 ImGui::Text("%d", row.waitId);
                 ImGui::TableNextColumn();
-                ImGui::Text("0x%08X", row.currentPc);
+                ImGui::Text("0x%08X", row.pc);
                 ImGui::TableNextColumn();
                 ImGui::Text("0x%08X", row.entry);
                 ImGui::TableNextColumn();
@@ -844,23 +801,21 @@ namespace
                 ImGui::TableNextColumn();
                 ImGui::Text("0x%08X", row.gp);
                 ImGui::TableNextColumn();
-                ImGui::Text("%d/%u", row.currentPriority, row.priority);
+                ImGui::Text("%d/%d", row.currentPriority, row.initialPriority);
                 ImGui::TableNextColumn();
-                ImGui::Text("%d", row.wakeupCount);
+                ImGui::Text("%u", row.wakeupCount);
                 ImGui::TableNextColumn();
                 ImGui::Text("%d", row.suspendCount);
-                ImGui::TableNextColumn();
-                ImGui::Text("%u", row.terminated ? 1u : 0u);
             }
             ImGui::EndTable();
         }
     }
 
-    void drawKernelTab()
+    void drawKernelTab(PS2Runtime &runtime)
     {
+        const EeKernelSnapshot snapshot = runtime.eeScheduler().snapshot();
         ImGui::SeparatorText("Semaphores");
         {
-            std::lock_guard<std::mutex> lock(g_sema_map_mutex);
             if (ImGui::BeginTable("semas", 7, ImGuiTableFlags_Borders | ImGuiTableFlags_RowBg | ImGuiTableFlags_Resizable))
             {
                 ImGui::TableSetupColumn("ID");
@@ -871,26 +826,23 @@ namespace
                 ImGui::TableSetupColumn("Attr");
                 ImGui::TableSetupColumn("Deleted");
                 ImGui::TableHeadersRow();
-                for (const auto &[id, sema] : g_semas)
+                for (const EeSemaphoreSnapshot &sema : snapshot.semaphores)
                 {
-                    if (!sema)
-                        continue;
-                    std::lock_guard<std::mutex> semaLock(sema->m);
                     ImGui::TableNextRow();
                     ImGui::TableNextColumn();
-                    ImGui::Text("%d", id);
+                    ImGui::Text("%d", sema.id);
                     ImGui::TableNextColumn();
-                    ImGui::Text("%d", sema->count);
+                    ImGui::Text("%d", sema.count);
                     ImGui::TableNextColumn();
-                    ImGui::Text("%d", sema->maxCount);
+                    ImGui::Text("%d", sema.maxCount);
                     ImGui::TableNextColumn();
-                    ImGui::Text("%d", sema->initCount);
+                    ImGui::Text("-");
                     ImGui::TableNextColumn();
-                    ImGui::Text("%d", sema->waiters);
+                    ImGui::Text("%u", sema.waiters);
                     ImGui::TableNextColumn();
-                    ImGui::Text("0x%08X", sema->attr);
+                    ImGui::Text("-");
                     ImGui::TableNextColumn();
-                    ImGui::Text("%u", sema->deleted ? 1u : 0u);
+                    ImGui::Text("0");
                 }
                 ImGui::EndTable();
             }
@@ -898,7 +850,6 @@ namespace
 
         ImGui::SeparatorText("Event flags");
         {
-            std::lock_guard<std::mutex> lock(g_event_flag_map_mutex);
             if (ImGui::BeginTable("evf", 6, ImGuiTableFlags_Borders | ImGuiTableFlags_RowBg | ImGuiTableFlags_Resizable))
             {
                 ImGui::TableSetupColumn("ID");
@@ -908,24 +859,21 @@ namespace
                 ImGui::TableSetupColumn("Attr");
                 ImGui::TableSetupColumn("Deleted");
                 ImGui::TableHeadersRow();
-                for (const auto &[id, evf] : g_eventFlags)
+                for (const EeEventFlagSnapshot &evf : snapshot.eventFlags)
                 {
-                    if (!evf)
-                        continue;
-                    std::lock_guard<std::mutex> evfLock(evf->m);
                     ImGui::TableNextRow();
                     ImGui::TableNextColumn();
-                    ImGui::Text("%d", id);
+                    ImGui::Text("%d", evf.id);
                     ImGui::TableNextColumn();
-                    ImGui::Text("0x%08X", evf->bits);
+                    ImGui::Text("0x%08X", evf.bits);
                     ImGui::TableNextColumn();
-                    ImGui::Text("0x%08X", evf->initBits);
+                    ImGui::Text("0x%08X", evf.initBits);
                     ImGui::TableNextColumn();
-                    ImGui::Text("%d", evf->waiters);
+                    ImGui::Text("%u", evf.waiters);
                     ImGui::TableNextColumn();
-                    ImGui::Text("0x%08X", evf->attr);
+                    ImGui::Text("0x%08X", evf.attr);
                     ImGui::TableNextColumn();
-                    ImGui::Text("%u", evf->deleted ? 1u : 0u);
+                    ImGui::Text("0");
                 }
                 ImGui::EndTable();
             }
@@ -2249,12 +2197,12 @@ void PS2DebugPanel::draw(PS2Runtime &runtime)
             }
             if (ImGui::BeginTabItem("Threads"))
             {
-                drawThreadsTab();
+                drawThreadsTab(runtime);
                 ImGui::EndTabItem();
             }
             if (ImGui::BeginTabItem("Kernel"))
             {
-                drawKernelTab();
+                drawKernelTab(runtime);
                 ImGui::EndTabItem();
             }
             if (ImGui::BeginTabItem("IOP/SIF"))

ps2xRuntime/src/lib/ps2_gs_gpu.cpp

@@ -617,7 +617,7 @@ void GS::recordDebugEventUnlocked(GSDebugHistoryEntry entry)
         return;
     }
 
-    const uint64_t tick = ps2_syscalls::GetCurrentVSyncTick();
+    const uint64_t tick = m_privRegs ? m_privRegs->vsyncTick.load(std::memory_order_acquire) : 0u;
     if (m_debugLastVsyncTick == UINT64_MAX)
     {
         m_debugLastVsyncTick = tick;
@@ -960,7 +960,7 @@ void GS::latchHostPresentationFrameUnlocked()
     const GSPmodeState pmode = decodePmode(m_privRegs->pmode);
     const GSSmode2State smode2 = decodeSMode2(m_privRegs->smode2);
     const bool applyFieldMode = smode2.interlaced && !smode2.frameMode;
-    const bool oddField = (ps2_syscalls::GetCurrentVSyncTick() & 1ull) != 0ull;
+    const bool oddField = (m_privRegs->vsyncTick.load(std::memory_order_acquire) & 1ull) != 0ull;
     const GSFrameReg displayFrame1 = decodeDisplayFrame(m_privRegs->dispfb1);
     const GSFrameReg displayFrame2 = decodeDisplayFrame(m_privRegs->dispfb2);
     const GSDisplayReadOrigin displayOrigin1 = decodeDisplayReadOrigin(m_privRegs->dispfb1);

ps2xRuntime/src/lib/ps2_iop_host.cpp

@@ -458,21 +458,17 @@ bool PS2IopHostAdapter::invokeGuestFunction(uint64_t callToken,
                                             uint32_t a3,
                                             uint32_t *resultAddress)
 {
-    if (!m_activeContext || callToken == 0 || callToken != m_activeToken)
+    (void)callToken;
+    (void)address;
+    (void)a0;
+    (void)a1;
+    (void)a2;
+    (void)a3;
+    if (resultAddress)
     {
-        return false;
+        *resultAddress = 0u;
     }
-    return rpcInvokeFunction(m_activeRdram
-                                 ? m_activeRdram
-                                 : m_runtime.memory().getRDRAM(),
-                             m_activeContext,
-                             &m_runtime,
-                             address,
-                             a0,
-                             a1,
-                             a2,
-                             a3,
-                             resultAddress);
+    return false;
 }
 
 void PS2IopHostAdapter::log(ps2x::iop::LogLevel level, std::string_view message)

ps2xRuntime/src/lib/ps2_runtime.cpp

@@ -5,6 +5,7 @@
 #include "game_overrides.h"
 #include "ps2_runtime_macros.h"
 #include "runtime/ps2_gs_gpu.h"
+#include "runtime/ee_scheduler.h"
 #include "ThreadNaming.h"
 #include "Kernel/Stubs/Audio.h"
 #include "Kernel/Stubs/GS.h"
@@ -107,9 +108,6 @@ namespace
     };
 
     thread_local DispatchHistory g_dispatchHistory;
-    thread_local std::unordered_map<PS2Runtime *, uint32_t> g_guestExecutionDepths;
-    thread_local uint32_t g_deferredGuestYieldDepth = 0u;
-    thread_local bool g_deferredGuestYieldPending = false;
 
     bool computeFileCrc32(const std::string &path, uint32_t &crcOut)
     {
@@ -368,40 +366,6 @@ namespace
     }
 }
 
-PS2Runtime::GuestExecutionScope::GuestExecutionScope(PS2Runtime *runtime) noexcept
-    : m_runtime(runtime)
-{
-    if (m_runtime)
-    {
-        m_runtime->enterGuestExecution();
-    }
-}
-
-PS2Runtime::GuestExecutionScope::~GuestExecutionScope()
-{
-    if (m_runtime)
-    {
-        m_runtime->leaveGuestExecution();
-    }
-}
-
-PS2Runtime::GuestExecutionReleaseScope::GuestExecutionReleaseScope(PS2Runtime *runtime) noexcept
-    : m_runtime(runtime)
-{
-    if (m_runtime)
-    {
-        m_depth = m_runtime->releaseGuestExecution();
-    }
-}
-
-PS2Runtime::GuestExecutionReleaseScope::~GuestExecutionReleaseScope()
-{
-    if (m_runtime && m_depth != 0u)
-    {
-        m_runtime->reacquireGuestExecution(m_depth);
-    }
-}
-
 static void UploadFrame(Texture2D &tex, PS2Runtime *rt, uint32_t &outWidth, uint32_t &outHeight)
 {
     static uint64_t s_lastPresentationTick = std::numeric_limits<uint64_t>::max();
@@ -415,7 +379,7 @@ static void UploadFrame(Texture2D &tex, PS2Runtime *rt, uint32_t &outWidth, uint
     static std::vector<uint8_t> s_scratch;
     static std::vector<uint8_t> s_uploadBuffer(DEFAULT_FB_SIZE, 0u);
 
-    const uint64_t currentTick = ps2_syscalls::GetCurrentVSyncTick();
+    const uint64_t currentTick = rt->eeScheduler().currentVSyncTick();
     const bool needsLatch = !s_hasLatchedInitialFrame || currentTick != s_lastPresentationTick;
     if (needsLatch)
     {
@@ -510,6 +474,7 @@ PS2Runtime::PS2Runtime()
 {
     m_iopHost = std::make_unique<PS2IopHostAdapter>(*this);
     m_iopSubsystem = std::make_unique<ps2x::iop::IopSubsystem>(*m_iopHost);
+    m_eeScheduler = std::make_unique<EeScheduler>(*this);
 #if defined(PS2X_IOP_ENABLE_PLUGINS) && PS2X_IOP_ENABLE_PLUGINS && \
     !defined(PLATFORM_VITA) && (defined(_WIN32) || defined(__linux__))
     if (const char *applicationDirectory = GetApplicationDirectory();
@@ -559,7 +524,6 @@ PS2Runtime::~PS2Runtime()
     try
     {
         requestStop();
-        ps2_syscalls::detachAllGuestHostThreads();
         m_iopSubsystem.reset();
         m_iopHost.reset();
 #if defined(PLATFORM_VITA)
@@ -1928,249 +1892,6 @@ uint32_t PS2Runtime::reserveAsyncCallbackStack(uint32_t size, uint32_t alignment
     return top - 0x10u;
 }
 
-void PS2Runtime::dispatchLoop(uint8_t *rdram, R5900Context *ctx)
-{
-    uint32_t lastPc = std::numeric_limits<uint32_t>::max();
-    uint32_t samePcCount = 0;
-    constexpr uint32_t kSamePcYieldInterval = 0x4000u;
-
-    while (!isStopRequested())
-    {
-        const uint32_t pc = ctx->pc;
-
-        if (pc == lastPc)
-        {
-            ++samePcCount;
-            if ((samePcCount % kSamePcYieldInterval) == 0u)
-            {
-                PS2_IF_AGRESSIVE_LOGS({
-                    RUNTIME_LOG("CPU is doing some work at PC 0x" << std::hex << pc << ". PC not updating.");
-                });
-                std::this_thread::yield();
-            }
-        }
-        else
-        {
-            samePcCount = 0;
-            lastPc = pc;
-        }
-
-        m_debugPc.store(pc, std::memory_order_relaxed);
-        m_debugRa.store(static_cast<uint32_t>(_mm_extract_epi32(ctx->r[31], 0)), std::memory_order_relaxed);
-        m_debugSp.store(static_cast<uint32_t>(_mm_extract_epi32(ctx->r[29], 0)), std::memory_order_relaxed);
-        m_debugGp.store(static_cast<uint32_t>(_mm_extract_epi32(ctx->r[28], 0)), std::memory_order_relaxed);
-
-        RecompiledFunction fn = lookupFunction(pc);
-        const uint32_t dispatchedPc = pc;
-        const uint32_t dispatchedRa = static_cast<uint32_t>(_mm_extract_epi32(ctx->r[31], 0));
-
-        uint64_t handoffBaseline = 0u;
-        {
-            GuestExecutionScope guestExecution(this);
-            fn(rdram, ctx, this);
-            handoffBaseline = guestExecutionHandoffEpochSnapshot();
-        }
-
-        waitForGuestExecutionHandoff(handoffBaseline);
-
-        if (ctx->pc == 0u)
-        {
-            const uint32_t ra = static_cast<uint32_t>(_mm_extract_epi32(ctx->r[31], 0));
-            const uint32_t sp = static_cast<uint32_t>(_mm_extract_epi32(ctx->r[29], 0));
-            const uint32_t gp = static_cast<uint32_t>(_mm_extract_epi32(ctx->r[28], 0));
-            PS2_IF_AGRESSIVE_LOGS({
-                std::cerr << "[dispatch:pc-zero] from=0x" << std::hex << dispatchedPc
-                          << " fromRa=0x" << dispatchedRa
-                          << " ra=0x" << ra
-                          << " sp=0x" << sp
-                          << " gp=0x" << gp
-                          << " trace=" << formatDispatchHistory()
-                          << std::dec << std::endl;
-            });
-
-            // PC=0 means this guest thread returned (usually via jr $ra with RA=0).
-            // Do not request a global runtime stop here: other guest threads may still run.
-            break;
-        }
-    }
-}
-
-void PS2Runtime::enterGuestExecution()
-{
-    uint32_t &depth = g_guestExecutionDepths[this];
-
-    if (depth != 0u)
-    {
-        m_guestExecutionMutex.lock();
-        ++depth;
-        return;
-    }
-
-    m_guestExecutionWaiters.fetch_add(1u, std::memory_order_acq_rel);
-    m_guestExecutionMutex.lock();
-    m_guestExecutionWaiters.fetch_sub(1u, std::memory_order_acq_rel);
-    depth = 1u;
-    markGuestExecutionAcquired();
-}
-
-void PS2Runtime::leaveGuestExecution()
-{
-    auto it = g_guestExecutionDepths.find(this);
-    if (it == g_guestExecutionDepths.end() || it->second == 0u)
-    {
-        return;
-    }
-
-    --it->second;
-    m_guestExecutionMutex.unlock();
-    if (it->second == 0u)
-    {
-        g_guestExecutionDepths.erase(it);
-    }
-}
-
-uint32_t PS2Runtime::releaseGuestExecution()
-{
-    auto it = g_guestExecutionDepths.find(this);
-    if (it == g_guestExecutionDepths.end() || it->second == 0u)
-    {
-        return 0u;
-    }
-
-    const uint32_t depth = it->second;
-    for (uint32_t i = 0; i < depth; ++i)
-    {
-        m_guestExecutionMutex.unlock();
-    }
-    g_guestExecutionDepths.erase(it);
-    return depth;
-}
-
-void PS2Runtime::reacquireGuestExecution(uint32_t depth)
-{
-    if (depth == 0u)
-    {
-        return;
-    }
-
-    uint32_t &heldDepth = g_guestExecutionDepths[this];
-    uint32_t remaining = depth;
-
-    if (heldDepth == 0u)
-    {
-        m_guestExecutionWaiters.fetch_add(1u, std::memory_order_acq_rel);
-        m_guestExecutionMutex.lock();
-        m_guestExecutionWaiters.fetch_sub(1u, std::memory_order_acq_rel);
-        heldDepth = 1u;
-        markGuestExecutionAcquired();
-        --remaining;
-    }
-
-    for (uint32_t i = 0; i < remaining; ++i)
-    {
-        m_guestExecutionMutex.lock();
-        ++heldDepth;
-    }
-}
-
-void PS2Runtime::markGuestExecutionAcquired()
-{
-    {
-        std::lock_guard<std::mutex> lock(m_guestExecutionHandoffMutex);
-        m_guestExecutionHandoffEpoch.fetch_add(1u, std::memory_order_acq_rel);
-    }
-    m_guestExecutionHandoffCv.notify_all();
-}
-
-void PS2Runtime::waitForGuestExecutionHandoff()
-{
-    waitForGuestExecutionHandoff(guestExecutionHandoffEpochSnapshot());
-}
-
-void PS2Runtime::waitForGuestExecutionHandoff(uint64_t baselineEpoch)
-{
-    // Lock-free fast path
-    if (m_guestExecutionWaiters.load(std::memory_order_acquire) == 0u)
-    {
-        return;
-    }
-
-    std::unique_lock<std::mutex> lock(m_guestExecutionHandoffMutex);
-
-    if (m_guestExecutionWaiters.load(std::memory_order_acquire) == 0u)
-    {
-        return;
-    }
-
-    const bool handedOff = m_guestExecutionHandoffCv.wait_for(
-        lock,
-        std::chrono::milliseconds(2),
-        [&]()
-        {
-            return m_guestExecutionWaiters.load(std::memory_order_acquire) == 0u ||
-                   m_guestExecutionHandoffEpoch.load(std::memory_order_relaxed) != baselineEpoch ||
-                   isStopRequested();
-        });
-
-    if (!handedOff)
-    {
-        m_guestExecutionHandoffTimeouts.fetch_add(1u, std::memory_order_relaxed);
-    }
-}
-
-PS2Runtime::DeferredGuestYieldScope::DeferredGuestYieldScope(bool &pendingOut) noexcept
-    : m_pendingOut(pendingOut)
-{
-    ++g_deferredGuestYieldDepth;
-}
-
-PS2Runtime::DeferredGuestYieldScope::~DeferredGuestYieldScope()
-{
-    if (--g_deferredGuestYieldDepth == 0u && g_deferredGuestYieldPending)
-    {
-        g_deferredGuestYieldPending = false;
-        m_pendingOut = true;
-    }
-}
-
-void PS2Runtime::yieldGuestExecutionAfterWake()
-{
-    if (g_deferredGuestYieldDepth != 0u)
-    {
-        g_deferredGuestYieldPending = true;
-        return;
-    }
-
-    auto it = g_guestExecutionDepths.find(this);
-    if (it == g_guestExecutionDepths.end() || it->second == 0u)
-    {
-        std::this_thread::yield();
-        return;
-    }
-
-    const uint64_t handoffEpoch = m_guestExecutionHandoffEpoch.load(std::memory_order_acquire);
-    {
-        GuestExecutionReleaseScope releaseGuestExecution(this);
-        std::unique_lock<std::mutex> lock(m_guestExecutionHandoffMutex);
-        m_guestExecutionHandoffCv.wait_for(lock, std::chrono::milliseconds(2), [&]()
-                                           { return m_guestExecutionHandoffEpoch.load(std::memory_order_acquire) != handoffEpoch; });
-    }
-}
-
-bool PS2Runtime::shouldPreemptGuestExecution()
-{
-    thread_local uint32_t s_backEdgeYieldCounter = 0u;
-    const uint32_t waiterCount = m_guestExecutionWaiters.load(std::memory_order_acquire);
-    const uint32_t yieldInterval = (waiterCount != 0u) ? 64u : 100u;
-    if (++s_backEdgeYieldCounter < yieldInterval)
-    {
-        return false;
-    }
-
-    s_backEdgeYieldCounter = 0u;
-    return true;
-}
-
 uint8_t PS2Runtime::Load8(uint8_t *rdram, R5900Context *ctx, uint32_t vaddr)
 {
     try
@@ -2341,7 +2062,10 @@ void PS2Runtime::kickGifDmaChainFromMMIO(uint8_t *rdram,
 void PS2Runtime::requestStop()
 {
     m_stopRequested.store(true, std::memory_order_relaxed);
-    ps2_syscalls::notifyRuntimeStop();
+    if (m_eeScheduler)
+    {
+        m_eeScheduler->requestStop();
+    }
 }
 
 bool PS2Runtime::isStopRequested() const
@@ -2349,6 +2073,134 @@ bool PS2Runtime::isStopRequested() const
     return m_stopRequested.load(std::memory_order_relaxed);
 }
 
+EeScheduler &PS2Runtime::eeScheduler()
+{
+    return *m_eeScheduler;
+}
+
+const EeScheduler &PS2Runtime::eeScheduler() const
+{
+    return *m_eeScheduler;
+}
+
+void PS2Runtime::postEeEvent(EeEvent event)
+{
+    m_eeScheduler->postEvent(event);
+}
+
+bool PS2Runtime::eeCheckpointDue() const noexcept
+{
+    return m_eeScheduler->checkpointDue();
+}
+
+void PS2Runtime::addEeExitHandler(int threadId, uint32_t function, uint32_t argument)
+{
+    std::lock_guard lock(m_eeKernelStateMutex);
+    m_eeExitHandlers[threadId].push_back({function, argument});
+}
+
+std::vector<PS2Runtime::EeExitHandlerRegistration> PS2Runtime::takeEeExitHandlers(int threadId)
+{
+    std::lock_guard lock(m_eeKernelStateMutex);
+    auto it = m_eeExitHandlers.find(threadId);
+    if (it == m_eeExitHandlers.end())
+    {
+        return {};
+    }
+    auto handlers = std::move(it->second);
+    m_eeExitHandlers.erase(it);
+    return handlers;
+}
+
+void PS2Runtime::removeEeExitHandlers(int threadId)
+{
+    std::lock_guard lock(m_eeKernelStateMutex);
+    m_eeExitHandlers.erase(threadId);
+}
+
+bool PS2Runtime::findEeSyscallOverride(uint32_t syscallNumber, uint32_t &handler) const
+{
+    std::lock_guard lock(m_eeKernelStateMutex);
+    const auto it = m_eeSyscallOverrides.find(syscallNumber);
+    if (it == m_eeSyscallOverrides.end())
+    {
+        return false;
+    }
+    handler = it->second;
+    return true;
+}
+
+void PS2Runtime::setEeSyscallOverride(uint8_t *rdram, uint32_t syscallNumber, uint32_t handler)
+{
+    constexpr uint32_t kTableBase = 0x80011F80u & 0x1FFFFFFFu;
+    constexpr uint32_t kMirrorLimit = 0x00080000u;
+    const int64_t offset = static_cast<int64_t>(static_cast<int32_t>(syscallNumber)) * 4;
+    const int64_t address = static_cast<int64_t>(kTableBase) + offset;
+
+    std::lock_guard lock(m_eeKernelStateMutex);
+    if (handler == 0u)
+    {
+        m_eeSyscallOverrides.erase(syscallNumber);
+    }
+    else
+    {
+        m_eeSyscallOverrides[syscallNumber] = handler;
+    }
+    if (!rdram || address < 0 || address + 4 > kMirrorLimit)
+    {
+        return;
+    }
+    const uint32_t guestAddress = static_cast<uint32_t>(address);
+    std::memcpy(rdram + guestAddress, &handler, sizeof(handler));
+    if (handler == 0u)
+    {
+        m_eeSyscallMirrorAddresses.erase(guestAddress);
+    }
+    else
+    {
+        m_eeSyscallMirrorAddresses.insert(guestAddress);
+    }
+}
+
+void PS2Runtime::initializeEeKernelState(uint8_t *rdram)
+{
+    if (!rdram)
+    {
+        return;
+    }
+    constexpr uint32_t kTableGuestBase = 0x80011F80u;
+    constexpr uint32_t kTableBase = kTableGuestBase & 0x1FFFFFFFu;
+    constexpr uint32_t kMirrorLimit = 0x00080000u;
+    constexpr uint32_t kProbeBase = 0x000002F0u;
+
+    std::lock_guard lock(m_eeKernelStateMutex);
+    for (const uint32_t address : m_eeSyscallMirrorAddresses)
+    {
+        const uint32_t zero = 0u;
+        std::memcpy(rdram + address, &zero, sizeof(zero));
+    }
+    m_eeSyscallMirrorAddresses.clear();
+    const uint32_t high = kTableGuestBase >> 16;
+    const uint32_t low = kTableGuestBase & 0xFFFFu;
+    std::memcpy(rdram + kProbeBase, &high, sizeof(high));
+    std::memcpy(rdram + kProbeBase + 8u, &low, sizeof(low));
+    m_eeSyscallMirrorAddresses.insert(kProbeBase);
+    m_eeSyscallMirrorAddresses.insert(kProbeBase + 8u);
+
+    for (const auto &[syscallNumber, handler] : m_eeSyscallOverrides)
+    {
+        const int64_t offset = static_cast<int64_t>(static_cast<int32_t>(syscallNumber)) * 4;
+        const int64_t address = static_cast<int64_t>(kTableBase) + offset;
+        if (address < 0 || address + 4 > kMirrorLimit)
+        {
+            continue;
+        }
+        const uint32_t guestAddress = static_cast<uint32_t>(address);
+        std::memcpy(rdram + guestAddress, &handler, sizeof(handler));
+        m_eeSyscallMirrorAddresses.insert(guestAddress);
+    }
+}
+
 void PS2Runtime::HandleIntegerOverflow(R5900Context *ctx)
 {
     raiseCop0Exception(ctx, EXCEPTION_INTEGER_OVERFLOW);
@@ -2360,9 +2212,8 @@ void PS2Runtime::run()
     ps2_stubs::resetSifState();
     resetIop();
     ps2_stubs::resetAudioStubState();
-    ps2_stubs::resetGsSyncVCallbackState();
     ps2_stubs::resetMpegStubState();
-    ps2_syscalls::initializeGuestKernelState(m_memory.getRDRAM());
+    initializeEeKernelState(m_memory.getRDRAM());
     m_cpuContext.r[4] = _mm_setzero_si128();
     m_cpuContext.r[5] = _mm_setzero_si128();
     m_cpuContext.r[29] = _mm_set_epi64x(0, static_cast<int64_t>(PS2_RAM_SIZE - 0x10u));
@@ -2378,7 +2229,6 @@ void PS2Runtime::run()
     Texture2D frameTex = LoadTextureFromImage(blank);
     UnloadImage(blank);
 
-    g_activeThreads.store(1, std::memory_order_relaxed);
     std::atomic<bool> gameThreadFinished{false};
 
     std::thread gameThread([&]()
@@ -2386,7 +2236,8 @@ void PS2Runtime::run()
         ThreadNaming::SetCurrentThreadName("GameThread");
         try
         {
-            dispatchLoop(m_memory.getRDRAM(), &m_cpuContext);
+            m_eeScheduler->reset(m_memory.getRDRAM(), m_cpuContext);
+            m_eeScheduler->run();
             uint32_t pc = m_debugPc.load(std::memory_order_relaxed);
             RUNTIME_LOG("Game thread returned. PC=0x" << std::hex << pc
                       << " RA=0x" << static_cast<uint32_t>(_mm_extract_epi32(m_cpuContext.r[31], 0)) << std::dec << std::endl);
@@ -2399,13 +2250,10 @@ void PS2Runtime::run()
         {
             std::cerr << "Error during program execution: unknown exception" << std::endl;
         }
-        g_activeThreads.fetch_sub(1, std::memory_order_relaxed);
         gameThreadFinished.store(true, std::memory_order_release); });
 
-    ps2_syscalls::EnsureVSyncWorkerRunning(m_memory.getRDRAM(), this);
-
     uint64_t tick = 0;
-    while (!isStopRequested() && g_activeThreads.load(std::memory_order_relaxed) > 0)
+    while (!isStopRequested() && !gameThreadFinished.load(std::memory_order_acquire))
     {
         PS2_IF_AGRESSIVE_LOGS({
             tick++;
@@ -2420,7 +2268,7 @@ void PS2Runtime::run()
                 const uint32_t dbgRa = m_debugRa.load(std::memory_order_relaxed);
                 const uint32_t dbgSp = m_debugSp.load(std::memory_order_relaxed);
                 const uint32_t dbgGp = m_debugGp.load(std::memory_order_relaxed);
-                const int activeThreads = g_activeThreads.load(std::memory_order_relaxed);
+                const auto eeSnapshot = m_eeScheduler->snapshot();
 
                 RUNTIME_LOG("[run:tick] tick=" << tick
                                                << " pc=0x" << std::hex << dbgPc
@@ -2430,7 +2278,7 @@ void PS2Runtime::run()
                                                << " dispfb1=0x" << gs.dispfb1
                                                << " display1=0x" << gs.display1
                                                << std::dec
-                                               << " activeThreads=" << activeThreads
+                                               << " activeThreads=" << eeSnapshot.threads.size()
                                                << " dma=" << curDma
                                                << " gif=" << curGif
                                                << " gsw=" << curGs
@@ -2473,54 +2321,9 @@ void PS2Runtime::run()
     }
 
     requestStop();
-
-    const auto joinDeadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
-    while (!gameThreadFinished.load(std::memory_order_acquire) &&
-           std::chrono::steady_clock::now() < joinDeadline)
-    {
-        std::this_thread::sleep_for(std::chrono::milliseconds(1));
-    }
-
     if (gameThread.joinable())
     {
-        if (gameThreadFinished.load(std::memory_order_acquire))
-        {
-            gameThread.join();
-        }
-        else
-        {
-            std::cerr << "[run] game thread did not stop within timeout; detaching" << std::endl;
-            gameThread.detach();
-        }
-    }
-
-    const auto workerDeadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(1000);
-    while (g_activeThreads.load(std::memory_order_relaxed) > 0 &&
-           std::chrono::steady_clock::now() < workerDeadline)
-    {
-        std::this_thread::sleep_for(std::chrono::milliseconds(1));
-    }
-
-    if (g_activeThreads.load(std::memory_order_relaxed) > 0)
-    {
-        requestStop();
-        const auto finalWorkerDeadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(1000);
-        while (g_activeThreads.load(std::memory_order_relaxed) > 0 &&
-               std::chrono::steady_clock::now() < finalWorkerDeadline)
-        {
-            std::this_thread::sleep_for(std::chrono::milliseconds(1));
-        }
-    }
-
-    if (g_activeThreads.load(std::memory_order_relaxed) == 0)
-    {
-        ps2_syscalls::joinAllGuestHostThreads();
-    }
-    else
-    {
-        std::cerr << "[run] guest host threads did not stop within timeout; detaching remaining worker threads"
-                  << std::endl;
-        ps2_syscalls::detachAllGuestHostThreads();
+        gameThread.join();
     }
 
     if (m_debugUiInitialized && m_debugUiShutdownCallback)
@@ -2531,11 +2334,5 @@ void PS2Runtime::run()
     UnloadTexture(frameTex);
     CloseWindow();
 
-    const int remainingThreads = g_activeThreads.load(std::memory_order_relaxed);
-    RUNTIME_LOG("[run] exiting loop, activeThreads=" << remainingThreads);
-    if (remainingThreads > 0)
-    {
-        std::cerr << "[run] warning: " << remainingThreads
-                  << " guest worker thread(s) still active during shutdown." << std::endl;
-    }
+    RUNTIME_LOG("[run] exiting loop");
 }

ps2xRuntime/src/main.cpp

@@ -26,38 +26,69 @@
 namespace
 {
 #if defined(__ANDROID__)
+    int g_logcatPipeFds[2]{-1, -1};
+    std::thread g_logcatThread;
+
+    void stopLogcatRedirect()
+    {
+        std::fflush(stdout);
+        std::fflush(stderr);
+        close(STDOUT_FILENO);
+        close(STDERR_FILENO);
+        if (g_logcatPipeFds[1] >= 0)
+        {
+            close(g_logcatPipeFds[1]);
+            g_logcatPipeFds[1] = -1;
+        }
+        if (g_logcatThread.joinable())
+        {
+            g_logcatThread.join();
+        }
+    }
+
     void redirectStdioToLogcat()
     {
-        static int pipeFds[2];
-        if (pipe(pipeFds) != 0)
+        if (pipe(g_logcatPipeFds) != 0)
         {
             return;
         }
 
         setvbuf(stdout, nullptr, _IOLBF, 0);
         setvbuf(stderr, nullptr, _IONBF, 0);
-        dup2(pipeFds[1], STDOUT_FILENO);
-        dup2(pipeFds[1], STDERR_FILENO);
+        dup2(g_logcatPipeFds[1], STDOUT_FILENO);
+        dup2(g_logcatPipeFds[1], STDERR_FILENO);
 
-        std::thread([]()
-                    {
-                        FILE *reader = fdopen(pipeFds[0], "r");
-                        if (!reader)
-                        {
-                            return;
-                        }
-                        char line[1024];
-                        while (fgets(line, sizeof(line), reader))
-                        {
-                            size_t len = std::strlen(line);
-                            if (len > 0 && line[len - 1] == '\n')
-                            {
-                                line[len - 1] = '\0';
-                            }
-                            __android_log_write(ANDROID_LOG_INFO, "ps2x", line);
-                        }
-                    })
-            .detach();
+        g_logcatThread = std::thread([]()
+                                     {
+                                         FILE *reader = fdopen(g_logcatPipeFds[0], "r");
+                                         if (!reader)
+                                         {
+                                             return;
+                                         }
+                                         char line[1024];
+                                         while (fgets(line, sizeof(line), reader))
+                                         {
+                                             size_t len = std::strlen(line);
+                                             if (len > 0 && line[len - 1] == '\n')
+                                             {
+                                                 line[len - 1] = '\0';
+                                             }
+                                             __android_log_write(ANDROID_LOG_INFO, "ps2x", line);
+                                         }
+                                         fclose(reader);
+                                         g_logcatPipeFds[0] = -1;
+                                     });
+        if (std::atexit(stopLogcatRedirect) != 0)
+        {
+            close(STDOUT_FILENO);
+            close(STDERR_FILENO);
+            close(g_logcatPipeFds[1]);
+            g_logcatPipeFds[1] = -1;
+            if (g_logcatThread.joinable())
+            {
+                g_logcatThread.join();
+            }
+        }
     }
 #endif
 

ps2xTest/src/code_generator_tests.cpp

@@ -156,6 +156,34 @@ void register_code_generator_tests()
 {
     MiniTest::Case("CodeGenerator", [](TestCase &tc)
                    {
+    tc.Run("SYSCALL publishes its continuation before entering the runtime", [](TestCase &t) {
+        Function func;
+        func.name = "syscall_resume";
+        func.start = 0x9000;
+        func.end = 0x9008;
+        func.isRecompiled = true;
+
+        Instruction syscall{};
+        syscall.address = 0x9000;
+        syscall.opcode = OPCODE_SPECIAL;
+        syscall.function = SPECIAL_SYSCALL;
+        syscall.raw = (0x44u << 6) | SPECIAL_SYSCALL;
+
+        Instruction after = makeNop(0x9004);
+
+        CodeGenerator gen({}, {});
+        const std::string generated = gen.generateFunction(func, {syscall, after}, false);
+        const size_t continuation = generated.find("ctx->pc = 0x9004u;");
+        const size_t dispatch = generated.find("runtime->handleSyscall(rdram, ctx, 0x44u);");
+
+        t.IsTrue(continuation != std::string::npos,
+                 "generated syscall must publish the next guest PC");
+        t.IsTrue(dispatch != std::string::npos,
+                 "generated syscall must still dispatch the encoded syscall");
+        t.IsTrue(continuation < dispatch,
+                 "the continuation PC must be visible before a syscall can transfer to the scheduler");
+    });
+
     tc.Run("R5900 MULT writes rd when rd is non-zero", [](TestCase &t) {
         CodeGenerator gen({}, {});
 
@@ -1174,6 +1202,35 @@ void register_code_generator_tests()
                      "JAL should pass call-site and fallthrough PCs to the runtime helper");
         });
 
+        tc.Run("JAL to a resolved syscall publishes fallthrough before the handler", [](TestCase &t) {
+            Function func;
+            func.name = "jal_syscall_resume";
+            func.start = 0xA040;
+            func.end = 0xA048;
+            func.isRecompiled = true;
+
+            Symbol target;
+            target.name = "GetThreadId";
+            target.address = 0xB040;
+            target.isFunction = true;
+
+            CodeGenerator gen({target}, {});
+            gen.setRelocationCallNames({{0xA040u, "GetThreadId"}});
+            const std::string generated = gen.generateFunction(
+                func, {makeJal(0xA040, 0xB040), makeNop(0xA044)}, false);
+            const size_t continuation = generated.find("ctx->pc = 0xA048u;");
+            const size_t handler = generated.find("ps2_syscalls::GetThreadId(rdram, ctx, runtime);");
+
+            t.IsTrue(continuation != std::string::npos,
+                     "a resolved HLE JAL should publish its fallthrough PC");
+            t.IsTrue(handler != std::string::npos,
+                     "the resolved syscall handler should still be called directly");
+            t.IsTrue(continuation < handler,
+                     "the fallthrough must be restart-safe before a blocking HLE handler runs");
+            t.IsTrue(generated.find("__entryPc") == std::string::npos,
+                     "resolved HLE calls must not retain the unchanged-PC compatibility guard");
+        });
+
         tc.Run("trailing JAL without decoded delay slot still emits call flow", [](TestCase &t) {
             Function func;
             func.name = "jal_truncated";
@@ -1317,8 +1374,8 @@ void register_code_generator_tests()
                      "mid-function backward loop head should be re-enterable after returning to the dispatcher");
             t.IsTrue(generated.find("ctx->pc = 0x1104u;") != std::string::npos,
                      "backward internal branch should preserve the loop target in ctx->pc");
-            t.IsTrue(generated.find("if (runtime->shouldPreemptGuestExecution()) {") != std::string::npos,
-                     "backward internal branch should consult the runtime preemption policy before re-entering the loop");
+            t.IsTrue(generated.find("if (runtime->eeCheckpointDue()) {") != std::string::npos,
+                     "backward internal branch should consult the EE event checkpoint before re-entering the loop");
             t.IsTrue(generated.find("return;") != std::string::npos,
                      "backward internal branch should return to the dispatcher when the runtime preemption policy requests it");
             t.IsTrue(generated.find("runtime->cooperativeGuestYield();") == std::string::npos,

ps2xTest/src/ps2_gs_tests.cpp

@@ -4,6 +4,7 @@
 #include "ps2_stubs.h"
 #include "ps2_syscalls.h"
 #include "runtime/ps2_gs_gpu.h"
+#include "runtime/ee_scheduler.h"
 #include "runtime/ps2_gs_memory.h"
 #include "runtime/ps2_gs_psmct32.h"
 #include "runtime/ps2_gs_psmt4.h"
@@ -24,6 +25,21 @@ namespace
 {
     std::atomic<uint32_t> g_gsSyncCallbackHits{0u};
     std::atomic<uint32_t> g_gsSyncCallbackLastTick{0u};
+    std::atomic<int32_t> g_gsSyncFirstField{-1};
+    std::atomic<int32_t> g_gsSyncSecondField{-1};
+    std::atomic<uint32_t> g_gsSyncCallbackSp{0u};
+    std::atomic<uint32_t> g_gsSyncCallbackGp{0u};
+    std::atomic<uint32_t> g_gsSyncCallbackPrevious{0u};
+
+    constexpr uint32_t kGsSyncWait0Pc = 0x0011F000u;
+    constexpr uint32_t kGsSyncResume0Pc = 0x0011F010u;
+    constexpr uint32_t kGsSyncWait1Pc = 0x0011F020u;
+    constexpr uint32_t kGsSyncResume1Pc = 0x0011F030u;
+    constexpr uint32_t kGsCallbackMainPc = 0x0011F040u;
+    constexpr uint32_t kGsCallbackResumePc = 0x0011F050u;
+    constexpr uint32_t kGsCallbackPc = 0x00120000u;
+    constexpr uint32_t kGsCallbackGp = 0x0036A7F0u;
+    constexpr uint32_t kGsCallbackCallerSp = 0x00123450u;
 
     static_assert(sizeof(GsImageMem) == 12, "GsImageMem size mismatch");
 
@@ -94,10 +110,54 @@ namespace
         (void)runtime;
 
         g_gsSyncCallbackLastTick.store(getRegU32(ctx, 4), std::memory_order_relaxed);
+        g_gsSyncCallbackSp.store(getRegU32(ctx, 29), std::memory_order_relaxed);
+        g_gsSyncCallbackGp.store(getRegU32(ctx, 28), std::memory_order_relaxed);
         g_gsSyncCallbackHits.fetch_add(1u, std::memory_order_relaxed);
         ctx->pc = 0u;
     }
 
+    void testGsSyncWait0(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        ctx->pc = kGsSyncResume0Pc;
+        ps2_stubs::sceGsSyncV(rdram, ctx, runtime);
+    }
+
+    void testGsSyncResume0(uint8_t *, R5900Context *ctx, PS2Runtime *)
+    {
+        g_gsSyncFirstField.store(static_cast<int32_t>(getRegU32(ctx, 2)), std::memory_order_release);
+        ctx->pc = kGsSyncWait1Pc;
+    }
+
+    void testGsSyncWait1(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        ctx->pc = kGsSyncResume1Pc;
+        ps2_stubs::sceGsSyncV(rdram, ctx, runtime);
+    }
+
+    void testGsSyncResume1(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_gsSyncSecondField.store(static_cast<int32_t>(getRegU32(ctx, 2)), std::memory_order_release);
+        ctx->pc = 0u;
+        runtime->requestStop();
+    }
+
+    void testGsCallbackMain(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        setRegU32(*ctx, 4, kGsCallbackPc);
+        setRegU32(*ctx, 28, kGsCallbackGp);
+        setRegU32(*ctx, 29, kGsCallbackCallerSp);
+        ctx->pc = kGsCallbackResumePc;
+        ps2_stubs::sceGsSyncVCallback(rdram, ctx, runtime);
+        g_gsSyncCallbackPrevious.store(getRegU32(ctx, 2), std::memory_order_release);
+        ps2_syscalls::WaitVSyncTick(rdram, ctx, runtime, -1);
+    }
+
+    void testGsCallbackResume(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        ctx->pc = 0u;
+        runtime->requestStop();
+    }
+
     void writeGsImageTest(uint8_t *rdram, uint32_t addr, const GsImageMem &image)
     {
         std::memcpy(rdram + addr, &image, sizeof(image));
@@ -3343,11 +3403,8 @@ void register_ps2_gs_tests()
                                     "sceGsResetGraph should free its temporary GIF packet");
         });
 
-        tc.Run("sceGsSyncV waits on VBlank and reports interlaced field parity", [](TestCase &t)
+        tc.Run("sceGsSyncV resumes through the scheduler with deterministic field parity", [](TestCase &t)
         {
-            notifyRuntimeStop();
-            ps2_stubs::resetGsSyncVCallbackState();
-
             PS2Runtime runtime;
             t.IsTrue(runtime.memory().initialize(), "runtime memory initialize should succeed");
             std::vector<uint8_t> rdram(PS2_RAM_SIZE, 0u);
@@ -3358,66 +3415,57 @@ void register_ps2_gs_tests()
             setRegU32(resetCtx, 6, 2u);
             setRegU32(resetCtx, 7, 1u);
             ps2_stubs::sceGsResetGraph(rdram.data(), &resetCtx, &runtime);
+            runtime.registerFunction(kGsSyncWait0Pc, testGsSyncWait0);
+            runtime.registerFunction(kGsSyncResume0Pc, testGsSyncResume0);
+            runtime.registerFunction(kGsSyncWait1Pc, testGsSyncWait1);
+            runtime.registerFunction(kGsSyncResume1Pc, testGsSyncResume1);
+            g_gsSyncFirstField.store(-1, std::memory_order_release);
+            g_gsSyncSecondField.store(-1, std::memory_order_release);
 
-            R5900Context sync0{};
-            ps2_stubs::sceGsSyncV(rdram.data(), &sync0, &runtime);
-            t.Equals(static_cast<int32_t>(getRegU32Test(sync0, 2)), 0, "first interlaced sceGsSyncV should report even field");
+            R5900Context mainContext{};
+            mainContext.pc = kGsSyncWait0Pc;
+            runtime.eeScheduler().reset(rdram.data(), mainContext);
+            runtime.eeScheduler().run();
 
-            R5900Context sync1{};
-            ps2_stubs::sceGsSyncV(rdram.data(), &sync1, &runtime);
-            t.Equals(static_cast<int32_t>(getRegU32Test(sync1, 2)), 1, "second interlaced sceGsSyncV should report odd field");
-
-            R5900Context resetProgCtx{};
-            setRegU32(resetProgCtx, 4, 0u);
-            setRegU32(resetProgCtx, 5, 0u);
-            setRegU32(resetProgCtx, 6, 2u);
-            setRegU32(resetProgCtx, 7, 1u);
-            ps2_stubs::sceGsResetGraph(rdram.data(), &resetProgCtx, &runtime);
-
-            R5900Context syncProg{};
-            ps2_stubs::sceGsSyncV(rdram.data(), &syncProg, &runtime);
-            t.Equals(static_cast<int32_t>(getRegU32Test(syncProg, 2)), 1, "progressive sceGsSyncV should always return one");
-
-            runtime.requestStop();
-            notifyRuntimeStop();
-            ps2_stubs::resetGsSyncVCallbackState();
+            t.Equals(g_gsSyncFirstField.load(std::memory_order_acquire), 0,
+                     "first interlaced VBlank should report even field");
+            t.Equals(g_gsSyncSecondField.load(std::memory_order_acquire), 1,
+                     "second interlaced VBlank should report odd field");
         });
 
-        tc.Run("sceGsSyncVCallback uses the shared VBlank worker", [](TestCase &t)
+        tc.Run("sceGsSyncVCallback runs as a scheduler invocation on its callback stack", [](TestCase &t)
         {
-            notifyRuntimeStop();
-            ps2_stubs::resetGsSyncVCallbackState();
             g_gsSyncCallbackHits.store(0u, std::memory_order_relaxed);
             g_gsSyncCallbackLastTick.store(0u, std::memory_order_relaxed);
+            g_gsSyncCallbackSp.store(0u, std::memory_order_relaxed);
+            g_gsSyncCallbackGp.store(0u, std::memory_order_relaxed);
+            g_gsSyncCallbackPrevious.store(0xFFFFFFFFu, std::memory_order_relaxed);
 
             PS2Runtime runtime;
             t.IsTrue(runtime.memory().initialize(), "runtime memory initialize should succeed");
             std::vector<uint8_t> rdram(PS2_RAM_SIZE, 0u);
+            runtime.configureGuestHeap(0x01F00000u, 0x01F00000u);
+            runtime.registerFunction(kGsCallbackMainPc, testGsCallbackMain);
+            runtime.registerFunction(kGsCallbackResumePc, testGsCallbackResume);
+            runtime.registerFunction(kGsCallbackPc, testGsSyncVCallback);
 
-            constexpr uint32_t kCallbackAddr = 0x120000u;
-            runtime.registerFunction(kCallbackAddr, testGsSyncVCallback);
+            R5900Context mainContext{};
+            mainContext.pc = kGsCallbackMainPc;
+            runtime.eeScheduler().reset(rdram.data(), mainContext);
+            runtime.eeScheduler().run();
 
-            R5900Context callbackCtx{};
-            setRegU32(callbackCtx, 4, kCallbackAddr);
-            ps2_stubs::sceGsSyncVCallback(rdram.data(), &callbackCtx, &runtime);
-            t.Equals(getRegU32Test(callbackCtx, 2), 0u, "first sceGsSyncVCallback registration should return no previous callback");
-
-            const bool callbackFired = waitUntil([]() {
-                return g_gsSyncCallbackHits.load(std::memory_order_acquire) > 0u;
-            }, std::chrono::milliseconds(80));
-
-            t.IsTrue(callbackFired, "registered GS VSync callback should fire from the VBlank worker");
+            t.Equals(g_gsSyncCallbackPrevious.load(std::memory_order_acquire), 0u,
+                     "first callback registration should return no previous callback");
+            t.Equals(g_gsSyncCallbackHits.load(std::memory_order_acquire), 1u,
+                     "the callback should execute once at the next VBlank boundary");
             t.IsTrue(g_gsSyncCallbackLastTick.load(std::memory_order_acquire) > 0u,
                      "VSync callback should receive a positive tick value");
-
-            R5900Context clearCtx{};
-            setRegU32(clearCtx, 4, 0u);
-            ps2_stubs::sceGsSyncVCallback(rdram.data(), &clearCtx, &runtime);
-            t.Equals(getRegU32Test(clearCtx, 2), kCallbackAddr, "clearing sceGsSyncVCallback should return the previous callback");
-
-            runtime.requestStop();
-            notifyRuntimeStop();
-            ps2_stubs::resetGsSyncVCallbackState();
+            t.Equals(g_gsSyncCallbackGp.load(std::memory_order_acquire), kGsCallbackGp,
+                     "callback invocation should preserve the registered GP");
+            t.IsTrue(g_gsSyncCallbackSp.load(std::memory_order_acquire) >= 0x01F00000u,
+                     "callback invocation should use the reserved async stack pool");
+            t.IsTrue(g_gsSyncCallbackSp.load(std::memory_order_acquire) != kGsCallbackCallerSp,
+                     "callback invocation must not reuse the caller stack");
         });
 
         tc.Run("GS T4HL/T4HH shared-plane upload preserves both index planes via RMW", [](TestCase &t)

ps2xTest/src/ps2_runtime_interrupt_tests.cpp

@@ -1,8 +1,7 @@
 #include "MiniTest.h"
 #include "ps2_runtime.h"
 #include "ps2_syscalls.h"
-#include "Stubs/DMA.h"
-#include "runtime/ps2_gs_gpu.h"
+#include "runtime/ee_scheduler.h"
 
 #include <atomic>
 #include <chrono>
@@ -46,12 +45,32 @@ namespace
         }
     };
 
-    std::atomic<uint32_t> g_vblankStartHits{0u};
-    std::atomic<uint32_t> g_vblankEndHits{0u};
     std::atomic<uint32_t> g_lastIntcArg{0u};
-    std::atomic<uint32_t> g_dmacSendHits{0u};
-    std::atomic<uint32_t> g_dmacSendLastCause{0u};
-    std::atomic<uint32_t> g_dmacSendLastChcr{0u};
+    constexpr uint32_t kIdleVSyncWaitPc = 0x00160000u;
+    constexpr uint32_t kVSyncWaitPc = 0x00160100u;
+    constexpr uint32_t kVSyncResumePc = 0x00160110u;
+    constexpr uint32_t kIrqWaitPc = 0x00160200u;
+    constexpr uint32_t kIrqResumePc = 0x00160210u;
+    constexpr uint32_t kIntcHandlerPc = 0x00160220u;
+    constexpr uint32_t kISemaWaitPc = 0x00160300u;
+    constexpr uint32_t kISemaResumePc = 0x00160310u;
+    constexpr uint32_t kISemaDriverPc = 0x00160320u;
+    constexpr uint32_t kISemaHandlerPc = 0x00160330u;
+    constexpr uint32_t kEventWaitPc = 0x00160400u;
+    constexpr uint32_t kEventResumePc = 0x00160410u;
+    constexpr uint32_t kEventProducerPc = 0x00160420u;
+
+    constexpr uint32_t kVSyncFlagAddr = 0x1800u;
+    constexpr uint32_t kVSyncTickAddr = 0x1810u;
+    constexpr uint32_t kEventResultAddr = 0x1820u;
+
+    std::vector<int> g_dispatchTrace;
+    int g_testSemaphoreId = 0;
+    int g_testEventFlagId = 0;
+    int32_t g_resumedResult = 0;
+    uint32_t g_vsyncFlag = 0;
+    uint64_t g_vsyncTick = 0;
+    uint64_t g_vsyncCsr = 0;
 
     void setRegU32(R5900Context &ctx, int reg, uint32_t value)
     {
@@ -73,25 +92,6 @@ namespace
         std::memcpy(rdram + addr, &value, sizeof(value));
     }
 
-    void writeGuestU64(uint8_t *rdram, uint32_t addr, uint64_t value)
-    {
-        std::memcpy(rdram + addr, &value, sizeof(value));
-    }
-
-    uint64_t makeDmaTag(uint16_t qwc, uint8_t id, uint32_t addr, bool irq = false)
-    {
-        return static_cast<uint64_t>(qwc) |
-               (static_cast<uint64_t>(id & 0x7u) << 28) |
-               (irq ? (1ull << 31) : 0ull) |
-               (static_cast<uint64_t>(addr & 0x7FFFFFFFu) << 32);
-    }
-
-    void writeDmaTag(uint8_t *rdram, uint32_t tagAddr, uint64_t tagLo)
-    {
-        std::memset(rdram + tagAddr, 0, 16);
-        std::memcpy(rdram + tagAddr, &tagLo, sizeof(tagLo));
-    }
-
     uint32_t readGuestU32(const uint8_t *rdram, uint32_t addr)
     {
         uint32_t value = 0;
@@ -124,58 +124,128 @@ namespace
     void cleanupRuntime(TestEnv &env)
     {
         env.runtime.requestStop();
-        notifyRuntimeStop();
     }
 
-    void testIntcHandler(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
+    void idleVSyncWait(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        (void)rdram;
-        (void)runtime;
+        WaitVSyncTick(rdram, ctx, runtime, -1);
+    }
 
-        const uint32_t cause = getRegU32(ctx, 4);
-        const uint32_t arg = getRegU32(ctx, 5);
-        g_lastIntcArg.store(arg, std::memory_order_relaxed);
+    void schedulerVSyncWait(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        EeScheduler &scheduler = runtime->eeScheduler();
+        scheduler.setVSyncFlag(kVSyncFlagAddr, kVSyncTickAddr);
+        ctx->pc = kVSyncResumePc;
+        scheduler.waitVSync(scheduler.currentVSyncTick());
+    }
 
-        if (cause == 2u)
-        {
-            g_vblankStartHits.fetch_add(1u, std::memory_order_relaxed);
-        }
-        else if (cause == 3u)
-        {
-            g_vblankEndHits.fetch_add(1u, std::memory_order_relaxed);
-        }
+    void schedulerVSyncResume(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_vsyncFlag = readGuestU32(rdram, kVSyncFlagAddr);
+        g_vsyncTick = readGuestU64(rdram, kVSyncTickAddr);
+        g_vsyncCsr = runtime->memory().gs().csr.load(std::memory_order_acquire);
+        g_resumedResult = getRegS32(*ctx, 2);
+        ctx->pc = 0u;
+        runtime->requestStop();
+    }
 
+    void schedulerIntcHandler(uint8_t *, R5900Context *ctx, PS2Runtime *)
+    {
+        g_dispatchTrace.push_back(2);
+        g_lastIntcArg.store(getRegU32(ctx, 5), std::memory_order_relaxed);
         ctx->pc = 0u;
     }
 
-    void testDmacSendHandler(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
+    void schedulerIrqWait(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
     {
-        (void)rdram;
-
-        const uint32_t cause = getRegU32(ctx, 4);
-        g_dmacSendHits.fetch_add(1u, std::memory_order_relaxed);
-        g_dmacSendLastCause.store(cause, std::memory_order_relaxed);
-
-        uint32_t channelBase = 0u;
-        if (cause == 0u)
-        {
-            channelBase = 0x10008000u;
-        }
-        else if (cause == 1u)
-        {
-            channelBase = 0x10009000u;
-        }
-        else if (cause == 2u)
-        {
-            channelBase = 0x1000A000u;
-        }
-
-        if (runtime && channelBase != 0u)
-        {
-            g_dmacSendLastChcr.store(runtime->memory().readIORegister(channelBase + 0x00u), std::memory_order_relaxed);
-        }
+        g_dispatchTrace.push_back(1);
+        EeScheduler &scheduler = runtime->eeScheduler();
+        scheduler.addIrqHandler(false, 2u, kIntcHandlerPc, true, 0xCAFEu, 0u, 0u);
+        ctx->pc = kIrqResumePc;
+        scheduler.waitVSync(scheduler.currentVSyncTick());
+    }
 
+    void schedulerIrqResume(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_dispatchTrace.push_back(3);
         ctx->pc = 0u;
+        runtime->requestStop();
+    }
+
+    void schedulerISemaHandler(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_dispatchTrace.push_back(3);
+        runtime->eeScheduler().signalSemaphore(g_testSemaphoreId, true);
+        g_dispatchTrace.push_back(4);
+        ctx->pc = 0u;
+    }
+
+    void schedulerISemaDriver(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_dispatchTrace.push_back(2);
+        ctx->pc = 0u;
+        runtime->eeScheduler().dispatchIrq(true, 5u);
+    }
+
+    void schedulerISemaWait(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_dispatchTrace.push_back(1);
+        EeScheduler &scheduler = runtime->eeScheduler();
+        g_testSemaphoreId = scheduler.createSemaphore(0, 1, 0u, 0u);
+        scheduler.addIrqHandler(true, 5u, kISemaHandlerPc, true, 0u, 0u, 0u);
+
+        EeThreadCreateParams driver{};
+        driver.entry = kISemaDriverPc;
+        driver.stack = 0x1C000u;
+        driver.stackSize = 0x1000u;
+        driver.priority = 10;
+        const int driverId = scheduler.createThread(driver);
+        scheduler.startThread(driverId, 0u, *ctx, false);
+
+        ctx->pc = kISemaResumePc;
+        scheduler.waitSemaphore(g_testSemaphoreId);
+    }
+
+    void schedulerISemaResume(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_dispatchTrace.push_back(5);
+        g_resumedResult = getRegS32(*ctx, 2);
+        ctx->pc = 0u;
+        runtime->requestStop();
+    }
+
+    void schedulerEventProducer(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_dispatchTrace.push_back(2);
+        ctx->pc = 0u;
+        runtime->eeScheduler().setEventFlag(g_testEventFlagId, 0x6u, false);
+        runtime->eeScheduler().transferIfRequested(false);
+    }
+
+    void schedulerEventWait(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_dispatchTrace.push_back(1);
+        EeScheduler &scheduler = runtime->eeScheduler();
+        g_testEventFlagId = scheduler.createEventFlag(0u, 0u, 0u);
+
+        EeThreadCreateParams producer{};
+        producer.entry = kEventProducerPc;
+        producer.stack = 0x1D000u;
+        producer.stackSize = 0x1000u;
+        producer.priority = 10;
+        const int producerId = scheduler.createThread(producer);
+        scheduler.startThread(producerId, 0u, *ctx, false);
+
+        ctx->pc = kEventResumePc;
+        scheduler.waitEventFlag(g_testEventFlagId, 0x2u, WEF_OR | WEF_CLEAR, kEventResultAddr);
+    }
+
+    void schedulerEventResume(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_dispatchTrace.push_back(3);
+        g_resumedResult = getRegS32(*ctx, 2);
+        ctx->pc = 0u;
+        runtime->requestStop();
     }
 }
 
@@ -183,443 +253,8 @@ void register_ps2_runtime_interrupt_tests()
 {
     MiniTest::Case("PS2RuntimeInterrupt", [](TestCase &tc)
     {
-        tc.Run("SetVSyncFlag arms a one-shot vblank notification", [](TestCase &t)
-        {
-            notifyRuntimeStop();
-            TestEnv env;
-
-            constexpr uint32_t kFlagAddr = 0x1000u;
-            constexpr uint32_t kTickAddr = 0x1010u;
-
-            writeGuestU32(env.rdram.data(), kFlagAddr, 0xDEADBEEFu);
-            writeGuestU32(env.rdram.data(), kTickAddr + 0u, 0xAAAAAAAAu);
-            writeGuestU32(env.rdram.data(), kTickAddr + 4u, 0xBBBBBBBBu);
-
-            R5900Context ctx{};
-            setRegU32(ctx, 4, kFlagAddr);
-            setRegU32(ctx, 5, kTickAddr);
-            t.IsTrue(callSyscall(0x73u, env.rdram.data(), &ctx, &env.runtime), "SetVSyncFlag syscall should dispatch");
-            t.Equals(getRegS32(ctx, 2), KE_OK, "SetVSyncFlag should return KE_OK");
-            t.Equals(readGuestU32(env.rdram.data(), kFlagAddr), 0u, "SetVSyncFlag should reset flag to zero");
-            t.Equals(readGuestU64(env.rdram.data(), kTickAddr), 0ull, "SetVSyncFlag should reset tick counter to zero");
-
-            const bool firstTickSeen = waitUntil([&]() {
-                return readGuestU64(env.rdram.data(), kTickAddr) > 0u;
-            }, std::chrono::milliseconds(300));
-            t.IsTrue(firstTickSeen, "VSync worker should update tick value");
-
-            const uint64_t firstTick = readGuestU64(env.rdram.data(), kTickAddr);
-            t.IsTrue(firstTick > 0u, "First observed VSync tick should be positive");
-            t.Equals(readGuestU32(env.rdram.data(), kFlagAddr), 1u, "VSync worker should set flag to one");
- 
-            const bool tickRewritten = waitUntil([&]() {
-                return readGuestU64(env.rdram.data(), kTickAddr) != firstTick;
-            }, std::chrono::milliseconds(100));
-            t.IsTrue(!tickRewritten, "consumed registration should not be written again");
-
-            // Re-arming registers a fresh one-shot notification.
-            writeGuestU32(env.rdram.data(), kFlagAddr, 0u);
-            R5900Context rearmCtx{};
-            setRegU32(rearmCtx, 4, kFlagAddr);
-            setRegU32(rearmCtx, 5, kTickAddr);
-            t.IsTrue(callSyscall(0x73u, env.rdram.data(), &rearmCtx, &env.runtime), "SetVSyncFlag re-arm should dispatch");
-            const bool rearmedTickSeen = waitUntil([&]() {
-                return readGuestU64(env.rdram.data(), kTickAddr) > firstTick;
-            }, std::chrono::milliseconds(300));
-            t.IsTrue(rearmedTickSeen, "re-armed registration should observe a later tick");
-            t.Equals(readGuestU32(env.rdram.data(), kFlagAddr), 1u, "re-armed registration should set flag to one");
-
-            cleanupRuntime(env);
-        });
-
-        tc.Run("VSync worker updates GS CSR FIELD bit for MMIO polling loops", [](TestCase &t)
-        {
-            notifyRuntimeStop();
-            TestEnv env;
-            t.IsTrue(env.runtime.memory().initialize(), "runtime memory initialize should succeed");
-
-            constexpr uint32_t kFlagAddr = 0x1080u;
-            constexpr uint32_t kTickAddr = 0x1090u;
-            constexpr uint64_t kGsCsrFieldMask = 0x2000ull;
-
-            env.runtime.memory().gs().csr = 0x3ull;
-
-            R5900Context ctx{};
-            setRegU32(ctx, 4, kFlagAddr);
-            setRegU32(ctx, 5, kTickAddr);
-            t.IsTrue(callSyscall(0x73u, env.rdram.data(), &ctx, &env.runtime), "SetVSyncFlag syscall should dispatch");
-
-            const uint64_t initialField = env.runtime.memory().gs().csr & kGsCsrFieldMask;
-            const bool firstFieldFlip = waitUntil([&]() {
-                return (env.runtime.memory().gs().csr & kGsCsrFieldMask) != initialField;
-            }, std::chrono::milliseconds(300));
-            t.IsTrue(firstFieldFlip, "VSync worker should toggle GS CSR FIELD for direct CSR polling");
-            t.Equals(env.runtime.memory().gs().csr & 0x3ull, 0x3ull, "VSync FIELD update should preserve CSR status bits");
-
-            const uint64_t fieldAfterFirstFlip = env.runtime.memory().gs().csr & kGsCsrFieldMask;
-            const bool secondFieldFlip = waitUntil([&]() {
-                return (env.runtime.memory().gs().csr & kGsCsrFieldMask) != fieldAfterFirstFlip;
-            }, std::chrono::milliseconds(300));
-            t.IsTrue(secondFieldFlip, "VSync worker should keep alternating GS CSR FIELD");
-
-            cleanupRuntime(env);
-        });
-
-        // Regression test for the GS CSR data race: a two-writer word-level
-        // lost-update guard. Pre-fix, every CSR update was a plain (non-atomic)
-        // 64-bit load-modify-store of the WHOLE word, so two threads that own
-        // logically disjoint bits could still clobber each other: thread A's
-        // read-modify-write of the word can overwrite thread B's bit with the
-        // stale value A loaded before B's update landed.
-        //
-        // Two racer threads with disjoint bit ownership run concurrently:
-        //   - racer A owns SIGNAL (bit 0): sets it via the GIF register path
-        //     (GS_REG_SIGNAL) then W1C-clears ONLY bit 0 via the MMIO write path;
-        //   - racer B owns FINISH (bit 1): same protocol with GS_REG_FINISH and
-        //     a W1C write of only bit 1.
-        // Each racer checks only its own bit after each half-op. With the fix
-        // (std::atomic CSR, every update a single atomic RMW) each racer is the
-        // sole writer of its bit, so its bit deterministically reflects its own
-        // last operation: zero anomalies are possible. Pre-fix, the racers'
-        // whole-word W1C RMWs constantly interleave and lose each other's
-        // set/clear, lighting up the anomaly counters.
-        //
-        // Why racer-vs-racer instead of racer-vs-vsync: the vsync worker (which
-        // motivated the fix) writes CSR only once per ~16.7ms tick, a window far
-        // too narrow to hit deterministically in a bounded test. The corrupting
-        // mechanism -- a non-atomic whole-word RMW clobbering a concurrently
-        // written disjoint bit -- is identical, so guarding it with two
-        // high-frequency writers also guards the vsync FIELD interleaving. The
-        // real vsync worker still runs throughout (started via the same
-        // SetVSyncFlag syscall production uses) and its FIELD (bit 13) toggling
-        // is asserted when at least two ticks were observed.
-        tc.Run("Disjoint-bit GS CSR writers (SIGNAL vs FINISH vs vsync FIELD) never lose word-level updates", [](TestCase &t)
-        {
-            notifyRuntimeStop();
-            TestEnv env;
-            t.IsTrue(env.runtime.memory().initialize(), "runtime memory initialize should succeed");
-
-            constexpr uint32_t kFlagAddr = 0x1180u;
-            constexpr uint32_t kTickAddr = 0x1190u;
-            constexpr uint64_t kGsCsrFieldMask = 0x2000ull;
-            constexpr uint32_t kCsrAddr = PS2_GS_PRIV_REG_BASE + 0x1000u;
-            constexpr uint32_t kIterations = 80000u;
-
-            GS gs;
-            gs.init(env.runtime.memory().getGSVRAM(), static_cast<uint32_t>(PS2_GS_VRAM_SIZE),
-                    &env.runtime.memory().gs());
-
-            // Drive the real vsync worker via the same syscall path production
-            // code uses; it runs on its own thread and toggles CSR.FIELD once
-            // per tick via updateGsCsrFieldForVSync.
-            R5900Context ctx{};
-            setRegU32(ctx, 4, kFlagAddr);
-            setRegU32(ctx, 5, kTickAddr);
-            t.IsTrue(callSyscall(0x73u, env.rdram.data(), &ctx, &env.runtime), "SetVSyncFlag syscall should dispatch");
-            const uint64_t tickBefore = GetCurrentVSyncTick();
-
-            std::atomic<uint32_t> setAnomaliesA{0u}, clearAnomaliesA{0u};
-            std::atomic<uint32_t> setAnomaliesB{0u}, clearAnomaliesB{0u};
-            std::atomic<uint32_t> racersDone{0u};
-
-            // ownBit: the single CSR status bit this racer exclusively owns.
-            // Each iteration: raise the bit via the GIF register-write path,
-            // verify it reads back set, W1C-clear only that bit via the guest
-            // MMIO path, verify it reads back clear. The other racer and the
-            // vsync worker never touch this bit, so under atomic RMWs both
-            // checks are exact -- any anomaly is a lost word-level update.
-            auto racerBody = [&](uint8_t gifReg, uint64_t gifValue, uint64_t ownBit,
-                                 std::atomic<uint32_t> &setAnomalies, std::atomic<uint32_t> &clearAnomalies) {
-                for (uint32_t i = 0; i < kIterations; ++i)
-                {
-                    gs.writeRegister(gifReg, gifValue);
-                    if ((env.runtime.memory().gs().csr.load() & ownBit) == 0ull)
-                    {
-                        setAnomalies.fetch_add(1u, std::memory_order_relaxed);
-                    }
-
-                    env.runtime.memory().write64(kCsrAddr, ownBit);
-                    if ((env.runtime.memory().gs().csr.load() & ownBit) != 0ull)
-                    {
-                        clearAnomalies.fetch_add(1u, std::memory_order_relaxed);
-                    }
-                }
-                racersDone.fetch_add(1u, std::memory_order_relaxed);
-            };
-
-            const uint64_t signalValue = (0xFFFFFFFFull << 32) | 0x11223344ull;
-            std::thread racerA(racerBody, GS_REG_SIGNAL, signalValue, 0x1ull,
-                               std::ref(setAnomaliesA), std::ref(clearAnomaliesA));
-            std::thread racerB(racerBody, GS_REG_FINISH, 0ull, 0x2ull,
-                               std::ref(setAnomaliesB), std::ref(clearAnomaliesB));
-
-            // While the racers hammer bits 0..1, watch for CSR.FIELD (bit 13)
-            // flips from the vsync worker. Polling ends when both racers finish,
-            // so this adds no fixed wall-clock cost.
-            const uint64_t initialField = env.runtime.memory().gs().csr.load() & kGsCsrFieldMask;
-            bool fieldFlipped = false;
-            while (racersDone.load(std::memory_order_relaxed) < 2u)
-            {
-                if ((env.runtime.memory().gs().csr.load() & kGsCsrFieldMask) != initialField)
-                {
-                    fieldFlipped = true;
-                }
-                std::this_thread::sleep_for(std::chrono::milliseconds(1));
-            }
-
-            racerA.join();
-            racerB.join();
-            const uint64_t ticksElapsed = GetCurrentVSyncTick() - tickBefore;
-
-            t.Equals(setAnomaliesA.load(), 0u, "racer A: SIGNAL set must never be lost to a concurrent whole-word CSR RMW");
-            t.Equals(clearAnomaliesA.load(), 0u, "racer A: SIGNAL W1C-clear must never be lost to a concurrent whole-word CSR RMW");
-            t.Equals(setAnomaliesB.load(), 0u, "racer B: FINISH set must never be lost to a concurrent whole-word CSR RMW");
-            t.Equals(clearAnomaliesB.load(), 0u, "racer B: FINISH W1C-clear must never be lost to a concurrent whole-word CSR RMW");
-            t.Equals(env.runtime.memory().gs().csr.load() & 0x3ull, 0x0ull,
-                     "final CSR status bits must match both racers' ledgers (last op on each bit was a clear)");
-            if (ticksElapsed >= 2u)
-            {
-                t.IsTrue(fieldFlipped, "VSync worker should toggle GS CSR FIELD while the racers run");
-            }
-
-            cleanupRuntime(env);
-        });
-
-        tc.Run("INTC VBLANK handlers respect EnableIntc and DisableIntc masks", [](TestCase &t)
-        {
-            notifyRuntimeStop();
-            TestEnv env;
-
-            g_vblankStartHits.store(0u, std::memory_order_relaxed);
-            g_vblankEndHits.store(0u, std::memory_order_relaxed);
-            g_lastIntcArg.store(0u, std::memory_order_relaxed);
-
-            constexpr uint32_t kFlagAddr = 0x1100u;
-            constexpr uint32_t kTickAddr = 0x1110u;
-            constexpr uint32_t kHandlerAddr = 0x00ABC100u;
-
-            env.runtime.registerFunction(kHandlerAddr, &testIntcHandler);
-
-            R5900Context addStart{};
-            setRegU32(addStart, 4, 2u); // VBLANK start
-            setRegU32(addStart, 5, kHandlerAddr);
-            setRegU32(addStart, 6, 0u);
-            setRegU32(addStart, 7, 0xCAFE0002u);
-            setRegU32(addStart, 28, 0x12340000u);
-            setRegU32(addStart, 29, 0x001FFFE0u);
-            t.IsTrue(callSyscall(0x10u, env.rdram.data(), &addStart, &env.runtime), "AddIntcHandler syscall should dispatch");
-            t.IsTrue(getRegS32(addStart, 2) > 0, "AddIntcHandler for cause 2 should return handler id");
-
-            R5900Context addEnd{};
-            setRegU32(addEnd, 4, 3u); // VBLANK end
-            setRegU32(addEnd, 5, kHandlerAddr);
-            setRegU32(addEnd, 6, 0u);
-            setRegU32(addEnd, 7, 0xCAFE0003u);
-            setRegU32(addEnd, 28, 0x12340000u);
-            setRegU32(addEnd, 29, 0x001FFFE0u);
-            t.IsTrue(callSyscall(0x10u, env.rdram.data(), &addEnd, &env.runtime), "AddIntcHandler syscall should dispatch");
-            t.IsTrue(getRegS32(addEnd, 2) > 0, "AddIntcHandler for cause 3 should return handler id");
-
-            R5900Context vsyncCtx{};
-            setRegU32(vsyncCtx, 4, kFlagAddr);
-            setRegU32(vsyncCtx, 5, kTickAddr);
-            t.IsTrue(callSyscall(0x73u, env.rdram.data(), &vsyncCtx, &env.runtime), "SetVSyncFlag syscall should dispatch");
-            t.Equals(getRegS32(vsyncCtx, 2), KE_OK, "SetVSyncFlag should succeed");
-
-            const bool startSeen = waitUntil([&]() {
-                return g_vblankStartHits.load(std::memory_order_relaxed) > 0u;
-            }, std::chrono::milliseconds(400));
-            const bool endSeen = waitUntil([&]() {
-                return g_vblankEndHits.load(std::memory_order_relaxed) > 0u;
-            }, std::chrono::milliseconds(400));
-
-            t.IsTrue(startSeen, "VBLANK start handler should fire while cause 2 is enabled");
-            t.IsTrue(endSeen, "VBLANK end handler should fire while cause 3 is enabled");
-
-            R5900Context disableStart{};
-            setRegU32(disableStart, 4, 2u);
-            t.IsTrue(callSyscall(0x15u, env.rdram.data(), &disableStart, &env.runtime), "DisableIntc syscall should dispatch");
-            t.Equals(getRegS32(disableStart, 2), KE_OK, "DisableIntc should return KE_OK");
-
-            std::this_thread::sleep_for(std::chrono::milliseconds(40));
-            const uint32_t startAfterDisable = g_vblankStartHits.load(std::memory_order_relaxed);
-            const uint32_t endAfterDisable = g_vblankEndHits.load(std::memory_order_relaxed);
-
-            std::this_thread::sleep_for(std::chrono::milliseconds(80));
-            const uint32_t startLater = g_vblankStartHits.load(std::memory_order_relaxed);
-            const uint32_t endLater = g_vblankEndHits.load(std::memory_order_relaxed);
-
-            t.Equals(startLater, startAfterDisable, "cause 2 handler count should stop increasing while cause 2 is disabled");
-            t.IsTrue(endLater > endAfterDisable, "cause 3 handler should keep firing while still enabled");
-
-            R5900Context enableStart{};
-            setRegU32(enableStart, 4, 2u);
-            t.IsTrue(callSyscall(0x14u, env.rdram.data(), &enableStart, &env.runtime), "EnableIntc syscall should dispatch");
-            t.Equals(getRegS32(enableStart, 2), KE_OK, "EnableIntc should return KE_OK");
-
-            const bool startResumed = waitUntil([&]() {
-                return g_vblankStartHits.load(std::memory_order_relaxed) > startLater;
-            }, std::chrono::milliseconds(300));
-            t.IsTrue(startResumed, "cause 2 handler should resume after re-enable");
-
-            const uint32_t lastArg = g_lastIntcArg.load(std::memory_order_relaxed);
-            t.IsTrue(lastArg == 0xCAFE0002u || lastArg == 0xCAFE0003u,
-                     "handler should receive configured argument value");
-
-            cleanupRuntime(env);
-        });
-
-        tc.Run("sceDmaSend dispatches completed VIF1 DMAC handler with latched END tag", [](TestCase &t)
-        {
-            notifyRuntimeStop();
-            TestEnv env;
-            t.IsTrue(env.runtime.memory().initialize(), "runtime memory initialize should succeed");
-
-            constexpr uint32_t kHandlerAddr = 0x00ABD100u;
-            constexpr uint32_t kVif1Ch = 0x10009000u;
-            constexpr uint32_t kTag0 = 0x00028000u;
-            constexpr uint32_t kTag1 = kTag0 + 0x20u;
-
-            uint8_t *rdram = env.runtime.memory().getRDRAM();
-            writeDmaTag(rdram, kTag0, makeDmaTag(1u, 1u, 0u, false)); // CNT
-            writeGuestU64(rdram, kTag0 + 0x10u, 0u);
-            writeGuestU64(rdram, kTag0 + 0x18u, 0u);
-            writeDmaTag(rdram, kTag1, makeDmaTag(0u, 7u, 0u, false)); // END
-
-            g_dmacSendHits.store(0u, std::memory_order_relaxed);
-            g_dmacSendLastCause.store(0u, std::memory_order_relaxed);
-            g_dmacSendLastChcr.store(0u, std::memory_order_relaxed);
-            env.runtime.registerFunction(kHandlerAddr, &testDmacSendHandler);
-
-            R5900Context addCtx{};
-            setRegU32(addCtx, 4, 1u);
-            setRegU32(addCtx, 5, kHandlerAddr);
-            setRegU32(addCtx, 6, 0u);
-            setRegU32(addCtx, 7, 0u);
-            ps2_syscalls::AddDmacHandler(rdram, &addCtx, &env.runtime);
-            t.IsTrue(getRegS32(addCtx, 2) > 0, "AddDmacHandler should register VIF1 handler");
-
-            R5900Context enableCtx{};
-            setRegU32(enableCtx, 4, 1u);
-            ps2_syscalls::EnableDmac(rdram, &enableCtx, &env.runtime);
-            t.Equals(getRegS32(enableCtx, 2), KE_OK, "EnableDmac should enable VIF1 cause");
-
-            R5900Context sendCtx{};
-            setRegU32(sendCtx, 4, kVif1Ch);
-            setRegU32(sendCtx, 5, kTag0);
-            ps2_stubs::sceDmaSend(rdram, &sendCtx, &env.runtime);
-
-            t.Equals(getRegS32(sendCtx, 2), 0, "sceDmaSend should succeed");
-            t.Equals(g_dmacSendHits.load(std::memory_order_relaxed), 1u, "sceDmaSend should dispatch the VIF1 DMAC handler");
-            t.Equals(g_dmacSendLastCause.load(std::memory_order_relaxed), 1u, "DMAC handler should observe VIF1 cause");
-            t.Equals(g_dmacSendLastChcr.load(std::memory_order_relaxed) & 0x100u, 0u, "handler should see VIF1 STR cleared");
-            t.Equals(g_dmacSendLastChcr.load(std::memory_order_relaxed) & 0x70000000u, 0x70000000u, "handler should see the latched END tag id");
-
-            cleanupRuntime(env);
-        });
-
-        tc.Run("MMIO VIF1 chain completion dispatches DMAC handler after CHCR store", [](TestCase &t)
-        {
-            notifyRuntimeStop();
-            TestEnv env;
-            t.IsTrue(env.runtime.memory().initialize(), "runtime memory initialize should succeed");
-
-            constexpr uint32_t kHandlerAddr = 0x00ABD180u;
-            constexpr uint32_t kVif1Ch = 0x10009000u;
-            constexpr uint32_t kTag0 = 0x00028200u;
-            constexpr uint32_t kTag1 = kTag0 + 0x20u;
-
-            uint8_t *rdram = env.runtime.memory().getRDRAM();
-            writeDmaTag(rdram, kTag0, makeDmaTag(1u, 1u, 0u, false)); // CNT
-            writeGuestU64(rdram, kTag0 + 0x10u, 0u);
-            writeGuestU64(rdram, kTag0 + 0x18u, 0u);
-            writeDmaTag(rdram, kTag1, makeDmaTag(0u, 7u, 0u, false)); // END
-
-            g_dmacSendHits.store(0u, std::memory_order_relaxed);
-            g_dmacSendLastCause.store(0u, std::memory_order_relaxed);
-            g_dmacSendLastChcr.store(0u, std::memory_order_relaxed);
-            env.runtime.registerFunction(kHandlerAddr, &testDmacSendHandler);
-
-            R5900Context addCtx{};
-            setRegU32(addCtx, 4, 1u);
-            setRegU32(addCtx, 5, kHandlerAddr);
-            setRegU32(addCtx, 6, 0u);
-            setRegU32(addCtx, 7, 0u);
-            ps2_syscalls::AddDmacHandler(rdram, &addCtx, &env.runtime);
-            t.IsTrue(getRegS32(addCtx, 2) > 0, "AddDmacHandler should register VIF1 handler");
-
-            R5900Context enableCtx{};
-            setRegU32(enableCtx, 4, 1u);
-            ps2_syscalls::EnableDmac(rdram, &enableCtx, &env.runtime);
-            t.Equals(getRegS32(enableCtx, 2), KE_OK, "EnableDmac should enable VIF1 cause");
-
-            R5900Context storeCtx{};
-            env.runtime.Store32(rdram, &storeCtx, kVif1Ch + 0x30u, kTag0);
-            env.runtime.Store32(rdram, &storeCtx, kVif1Ch + 0x00u, 0x185u);
-
-            t.Equals(g_dmacSendHits.load(std::memory_order_relaxed), 1u, "CHCR store should dispatch the VIF1 DMAC handler");
-            t.Equals(g_dmacSendLastCause.load(std::memory_order_relaxed), 1u, "DMAC handler should observe VIF1 cause");
-            t.Equals(g_dmacSendLastChcr.load(std::memory_order_relaxed) & 0x100u, 0u, "handler should see VIF1 STR cleared");
-            t.Equals(g_dmacSendLastChcr.load(std::memory_order_relaxed) & 0x70000000u, 0x70000000u, "handler should see the latched END tag id");
-
-            cleanupRuntime(env);
-        });
-
-        tc.Run("native GIF DMA MMIO kick dispatches completed DMAC handler", [](TestCase &t)
-        {
-            notifyRuntimeStop();
-            TestEnv env;
-            t.IsTrue(env.runtime.memory().initialize(), "runtime memory initialize should succeed");
-
-            constexpr uint32_t kHandlerAddr = 0x00ABD1C0u;
-            constexpr uint32_t kDStat = 0x1000E010u;
-            constexpr uint32_t kDPcr = 0x1000E020u;
-            constexpr uint32_t kTag0 = 0x00028400u;
-
-            uint8_t *rdram = env.runtime.memory().getRDRAM();
-            writeDmaTag(rdram, kTag0, makeDmaTag(1u, 7u, 0u, false)); // END
-            writeGuestU64(rdram, kTag0 + 0x10u, 0x1122334455667788ull);
-            writeGuestU64(rdram, kTag0 + 0x18u, 0x99AABBCCDDEEFF00ull);
-
-            g_dmacSendHits.store(0u, std::memory_order_relaxed);
-            g_dmacSendLastCause.store(0u, std::memory_order_relaxed);
-            g_dmacSendLastChcr.store(0u, std::memory_order_relaxed);
-            env.runtime.registerFunction(kHandlerAddr, &testDmacSendHandler);
-
-            R5900Context addCtx{};
-            setRegU32(addCtx, 4, 2u);
-            setRegU32(addCtx, 5, kHandlerAddr);
-            setRegU32(addCtx, 6, 0u);
-            setRegU32(addCtx, 7, 0u);
-            ps2_syscalls::AddDmacHandler(rdram, &addCtx, &env.runtime);
-            t.IsTrue(getRegS32(addCtx, 2) > 0, "AddDmacHandler should register GIF handler");
-
-            R5900Context enableCtx{};
-            setRegU32(enableCtx, 4, 2u);
-            ps2_syscalls::EnableDmac(rdram, &enableCtx, &env.runtime);
-            t.Equals(getRegS32(enableCtx, 2), KE_OK, "EnableDmac should enable GIF cause");
-
-            R5900Context kickCtx{};
-            env.runtime.kickGifDmaChainFromMMIO(rdram, &kickCtx, 4u, 4u, kTag0, 0x105u);
-
-            t.Equals(env.runtime.memory().readIORegister(kDPcr), 4u, "native GIF kick should preserve D_PCR write");
-            t.IsTrue((env.runtime.memory().readIORegister(kDStat) & (1u << 2)) != 0u,
-                     "native GIF kick should raise D_STAT GIF completion status");
-            t.Equals(g_dmacSendHits.load(std::memory_order_relaxed), 1u,
-                     "native GIF kick should dispatch the GIF DMAC handler");
-            t.Equals(g_dmacSendLastCause.load(std::memory_order_relaxed), 2u,
-                     "DMAC handler should observe GIF cause");
-            t.Equals(g_dmacSendLastChcr.load(std::memory_order_relaxed) & 0x100u, 0u,
-                     "handler should see GIF STR cleared");
-            t.Equals(g_dmacSendLastChcr.load(std::memory_order_relaxed) & 0x70000000u, 0x70000000u,
-                     "handler should see the latched END tag id");
-
-            cleanupRuntime(env);
-        });
-
         tc.Run("negative interrupt-safe EE syscall ids dispatch", [](TestCase &t)
         {
-            notifyRuntimeStop();
             TestEnv env;
 
             constexpr uint32_t kEventParamAddr = 0x1200u;
@@ -684,97 +319,8 @@ void register_ps2_runtime_interrupt_tests()
             cleanupRuntime(env);
         });
 
-        tc.Run("WaitEventFlag blocks and wakes when SetEventFlag publishes bits", [](TestCase &t)
-        {
-            notifyRuntimeStop();
-            TestEnv env;
-
-            constexpr uint32_t kParamAddr = 0x1200u;
-            constexpr uint32_t kResBitsAddr = 0x1300u;
-
-            const uint32_t eventParam[3] = {
-                0u, // attr
-                0u, // option
-                0u  // init bits
-            };
-            std::memcpy(env.rdram.data() + kParamAddr, eventParam, sizeof(eventParam));
-
-            R5900Context createCtx{};
-            setRegU32(createCtx, 4, kParamAddr);
-            CreateEventFlag(env.rdram.data(), &createCtx, &env.runtime);
-            const int32_t eid = getRegS32(createCtx, 2);
-            t.IsTrue(eid > 0, "CreateEventFlag should return a valid id");
-
-            writeGuestU32(env.rdram.data(), kResBitsAddr, 0u);
-
-            std::atomic<bool> waiterDone{false};
-            std::atomic<bool> waiterThrew{false};
-            std::atomic<int32_t> waiterRet{0x7FFFFFFF};
-            std::atomic<uint32_t> waiterResBits{0u};
-
-            std::thread waiter([&]()
-            {
-                try
-                {
-                    R5900Context waitCtx{};
-                    setRegU32(waitCtx, 4, static_cast<uint32_t>(eid));
-                    setRegU32(waitCtx, 5, 0x4u);      // wait bits
-                    setRegU32(waitCtx, 6, WEF_OR);    // OR mode
-                    setRegU32(waitCtx, 7, kResBitsAddr);
-                    WaitEventFlag(env.rdram.data(), &waitCtx, &env.runtime);
-                    waiterRet.store(getRegS32(waitCtx, 2), std::memory_order_relaxed);
-                    waiterResBits.store(readGuestU32(env.rdram.data(), kResBitsAddr), std::memory_order_relaxed);
-                }
-                catch (...)
-                {
-                    waiterThrew.store(true, std::memory_order_release);
-                }
-
-                waiterDone.store(true, std::memory_order_release);
-            });
-
-            std::this_thread::sleep_for(std::chrono::milliseconds(20));
-            t.IsFalse(waiterDone.load(std::memory_order_acquire), "WaitEventFlag should block before matching bits are set");
-
-            R5900Context signalCtx{};
-            setRegU32(signalCtx, 4, static_cast<uint32_t>(eid));
-            setRegU32(signalCtx, 5, 0x4u);
-            SetEventFlag(env.rdram.data(), &signalCtx, &env.runtime);
-            t.Equals(getRegS32(signalCtx, 2), KE_OK, "SetEventFlag should succeed");
-
-            const bool woke = waitUntil([&]() {
-                return waiterDone.load(std::memory_order_acquire);
-            }, std::chrono::milliseconds(300));
-            if (!woke)
-            {
-                // Force unblock for deterministic test cleanup.
-                R5900Context deleteCtx{};
-                setRegU32(deleteCtx, 4, static_cast<uint32_t>(eid));
-                DeleteEventFlag(env.rdram.data(), &deleteCtx, &env.runtime);
-            }
-
-            if (waiter.joinable())
-            {
-                waiter.join();
-            }
-
-            t.IsFalse(waiterThrew.load(std::memory_order_acquire),
-                      "WaitEventFlag waiter thread should not throw");
-            t.IsTrue(woke, "WaitEventFlag should wake after SetEventFlag publishes matching bits");
-            t.Equals(waiterRet.load(std::memory_order_relaxed), KE_OK, "waiter should return KE_OK");
-            t.IsTrue((waiterResBits.load(std::memory_order_relaxed) & 0x4u) != 0u,
-                     "waiter result bits should include published bit");
-
-            R5900Context deleteCtx{};
-            setRegU32(deleteCtx, 4, static_cast<uint32_t>(eid));
-            DeleteEventFlag(env.rdram.data(), &deleteCtx, &env.runtime);
-
-            cleanupRuntime(env);
-        });
-
         tc.Run("PollEventFlag WEF_CLEAR clears only matched bits", [](TestCase &t)
         {
-            notifyRuntimeStop();
             TestEnv env;
 
             constexpr uint32_t kParamAddr = 0x1400u;
@@ -830,60 +376,146 @@ void register_ps2_runtime_interrupt_tests()
             cleanupRuntime(env);
         });
 
-        tc.Run("WaitVSyncTick returns when runtime stop is requested", [](TestCase &t)
+        tc.Run("VBlank deadline resumes the waiter and publishes flag tick and FIELD atomically", [](TestCase &t)
         {
-            notifyRuntimeStop();
             TestEnv env;
+            t.IsTrue(env.runtime.memory().initialize(), "runtime memory initialize should succeed");
+            env.runtime.registerFunction(kVSyncWaitPc, schedulerVSyncWait);
+            env.runtime.registerFunction(kVSyncResumePc, schedulerVSyncResume);
 
-            std::atomic<bool> waiterDone{false};
-            std::atomic<bool> waiterThrew{false};
-            std::thread waiter([&]()
+            g_resumedResult = -1;
+            g_vsyncFlag = 0u;
+            g_vsyncTick = 0u;
+            g_vsyncCsr = 0u;
+            R5900Context mainContext{};
+            mainContext.pc = kVSyncWaitPc;
+            env.runtime.eeScheduler().reset(env.rdram.data(), mainContext);
+            env.runtime.eeScheduler().run();
+
+            t.Equals(g_vsyncFlag, 1u, "VBlank start should set the registered guest flag");
+            t.Equals(g_vsyncTick, 1ull, "the first centralized VBlank deadline should publish tick one");
+            t.Equals(g_resumedResult, 0, "the first VBlank field should return even-field parity");
+            t.Equals(g_vsyncCsr & 0x2000ull, 0x2000ull,
+                     "the first VBlank should publish GS CSR.FIELD before resuming guest code");
+        });
+
+        tc.Run("VBlank IRQ invocation completes before the resumed base context", [](TestCase &t)
+        {
+            TestEnv env;
+            env.runtime.registerFunction(kIrqWaitPc, schedulerIrqWait);
+            env.runtime.registerFunction(kIrqResumePc, schedulerIrqResume);
+            env.runtime.registerFunction(kIntcHandlerPc, schedulerIntcHandler);
+
+            g_dispatchTrace.clear();
+            g_lastIntcArg.store(0u, std::memory_order_relaxed);
+            R5900Context mainContext{};
+            mainContext.pc = kIrqWaitPc;
+            env.runtime.eeScheduler().reset(env.rdram.data(), mainContext);
+            env.runtime.eeScheduler().run();
+
+            const std::vector<int> expected{1, 2, 3};
+            t.IsTrue(g_dispatchTrace == expected,
+                     "the dispatcher should run wait, IRQ frame, then the resumed base context in exact order");
+            t.Equals(g_lastIntcArg.load(std::memory_order_relaxed), 0xCAFEu,
+                     "the IRQ frame should receive its registered argument");
+        });
+
+        tc.Run("iSignalSema defers selection until IRQ return", [](TestCase &t)
+        {
+            TestEnv env;
+            env.runtime.registerFunction(kISemaWaitPc, schedulerISemaWait);
+            env.runtime.registerFunction(kISemaResumePc, schedulerISemaResume);
+            env.runtime.registerFunction(kISemaDriverPc, schedulerISemaDriver);
+            env.runtime.registerFunction(kISemaHandlerPc, schedulerISemaHandler);
+
+            g_dispatchTrace.clear();
+            g_resumedResult = -1;
+            R5900Context mainContext{};
+            mainContext.pc = kISemaWaitPc;
+            env.runtime.eeScheduler().reset(env.rdram.data(), mainContext);
+            env.runtime.eeScheduler().run();
+
+            const std::vector<int> expected{1, 2, 3, 4, 5};
+            t.IsTrue(g_dispatchTrace == expected,
+                     "iSignalSema should make the waiter ready but finish the IRQ frame before selecting it");
+            t.Equals(g_resumedResult, g_testSemaphoreId,
+                     "the resumed waiter should receive the semaphore id from the direct FIFO handoff");
+            const EeSemaphore *semaphore = env.runtime.eeScheduler().semaphore(g_testSemaphoreId);
+            t.IsTrue(semaphore != nullptr, "the signaled semaphore should still exist");
+            if (semaphore)
+            {
+                t.Equals(semaphore->count, 0, "direct handoff must not increment the semaphore count");
+                t.Equals(static_cast<uint32_t>(semaphore->waiters.size()), 0u,
+                         "the awakened waiter must be removed from the semaphore queue");
+            }
+        });
+
+        tc.Run("event-flag completion writes observed bits before strict-priority resume", [](TestCase &t)
+        {
+            TestEnv env;
+            env.runtime.registerFunction(kEventWaitPc, schedulerEventWait);
+            env.runtime.registerFunction(kEventResumePc, schedulerEventResume);
+            env.runtime.registerFunction(kEventProducerPc, schedulerEventProducer);
+
+            g_dispatchTrace.clear();
+            g_resumedResult = -1;
+            R5900Context mainContext{};
+            mainContext.pc = kEventWaitPc;
+            env.runtime.eeScheduler().reset(env.rdram.data(), mainContext);
+            env.runtime.eeScheduler().run();
+
+            const std::vector<int> expected{1, 2, 3};
+            t.IsTrue(g_dispatchTrace == expected,
+                     "the higher-priority event waiter should resume at the producer scheduling point");
+            t.Equals(g_resumedResult, KE_OK, "the resumed event waiter should receive KE_OK");
+            t.Equals(readGuestU32(env.rdram.data(), kEventResultAddr), 0x6u,
+                     "the event output should contain the bits observed before clear mode is applied");
+            const EeEventFlag *flag = env.runtime.eeScheduler().eventFlag(g_testEventFlagId);
+            t.IsTrue(flag != nullptr, "the event flag should still exist");
+            if (flag)
+            {
+                t.Equals(flag->bits, 0x4u, "WEF_CLEAR should remove only the requested matched bit");
+            }
+        });
+
+        tc.Run("scheduler stop wakes an idle VSync wait without a timeout", [](TestCase &t)
+        {
+            TestEnv env;
+            env.runtime.registerFunction(kIdleVSyncWaitPc, idleVSyncWait);
+
+            R5900Context mainContext{};
+            mainContext.pc = kIdleVSyncWaitPc;
+            std::atomic<bool> schedulerDone{false};
+            std::atomic<bool> schedulerThrew{false};
+            std::thread gameThread([&]()
             {
                 try
                 {
-                    WaitVSyncTick(env.rdram.data(), &env.runtime);
+                    env.runtime.eeScheduler().reset(env.rdram.data(), mainContext);
+                    env.runtime.eeScheduler().run();
                 }
                 catch (...)
                 {
-                    waiterThrew.store(true, std::memory_order_release);
+                    schedulerThrew.store(true, std::memory_order_release);
                 }
-                waiterDone.store(true, std::memory_order_release);
+                schedulerDone.store(true, std::memory_order_release);
             });
 
-            std::this_thread::sleep_for(std::chrono::milliseconds(2));
-            env.runtime.requestStop();
-
-            bool wokeOnStop = waitUntil([&]() {
-                return waiterDone.load(std::memory_order_acquire);
+            const bool becameIdle = waitUntil([&]() {
+                const EeKernelSnapshot snapshot = env.runtime.eeScheduler().snapshot();
+                return snapshot.runningThreadId == 0 &&
+                       !snapshot.threads.empty() &&
+                       snapshot.threads.front().waitReason == EeWaitReason::VSync;
             }, std::chrono::milliseconds(80));
 
-            if (!wokeOnStop)
-            {
-                // Fallback wake-up for deterministic cleanup: one extra tick on fresh runtime.
-                TestEnv wakeEnv;
-                R5900Context setCtx{};
-                constexpr uint32_t kWakeFlagAddr = 0x1500u;
-                constexpr uint32_t kWakeTickAddr = 0x1510u;
-                setRegU32(setCtx, 4, kWakeFlagAddr);
-                setRegU32(setCtx, 5, kWakeTickAddr);
-                (void)callSyscall(0x73u, wakeEnv.rdram.data(), &setCtx, &wakeEnv.runtime);
-                (void)waitUntil([&]() {
-                    return readGuestU64(wakeEnv.rdram.data(), kWakeTickAddr) > 0u;
-                }, std::chrono::milliseconds(300));
-                wakeEnv.runtime.requestStop();
-                wokeOnStop = waitUntil([&]() {
-                    return waiterDone.load(std::memory_order_acquire);
-                }, std::chrono::milliseconds(80));
-            }
+            env.runtime.requestStop();
+            gameThread.join();
 
-            if (waiter.joinable())
-            {
-                waiter.join();
-            }
-
-            t.IsFalse(waiterThrew.load(std::memory_order_acquire),
-                      "WaitVSyncTick waiter thread should not throw");
-            t.IsTrue(wokeOnStop, "WaitVSyncTick waiter should unblock when runtime is stopping");
+            t.IsTrue(becameIdle, "VSync wait should leave the sole guest thread waiting");
+            t.IsTrue(schedulerDone.load(std::memory_order_acquire),
+                     "requestStop should wake the scheduler's event wait");
+            t.IsFalse(schedulerThrew.load(std::memory_order_acquire),
+                      "the scheduler stop path should not throw");
 
             cleanupRuntime(env);
         });

ps2xTest/src/ps2_sif_dma_tests.cpp

@@ -3,6 +3,7 @@
 #include "ps2_iop_transport.h"
 #include "ps2_syscalls.h"
 #include "ps2_stubs.h"
+#include "runtime/ee_scheduler.h"
 
 #include <array>
 #include <cstdint>
@@ -112,6 +113,13 @@ namespace
     uint32_t g_dmacHandlerValue = 0u;
     uint32_t g_dmacHandlerLastCause = 0u;
     uint32_t g_dmacHandlerLastArg = 0u;
+    int32_t g_sifDmaResult = 0;
+
+    constexpr uint32_t kSchedulerSifDmaEntryPc = 0x00101000u;
+    constexpr uint32_t kSchedulerSifDmaResumePc = 0x00101010u;
+    constexpr uint32_t kSchedulerSifDmaHandlerPc = 0x00101020u;
+    constexpr uint32_t kSchedulerSifDmaDescAddr = 0x00020300u;
+    constexpr uint32_t kSchedulerSifDmaHandlerArg = 0x12345678u;
 
     void testDmacHandler(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
@@ -124,6 +132,28 @@ namespace
         }
         ctx->pc = 0u;
     }
+
+    void schedulerSifDmaEntry(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        runtime->eeScheduler().addIrqHandler(true,
+                                             5u,
+                                             kSchedulerSifDmaHandlerPc,
+                                             true,
+                                             kSchedulerSifDmaHandlerArg,
+                                             0u,
+                                             0u);
+        setRegU32(*ctx, 4, kSchedulerSifDmaDescAddr);
+        setRegU32(*ctx, 5, 1u);
+        ctx->pc = kSchedulerSifDmaResumePc;
+        ps2_stubs::sceSifSetDma(rdram, ctx, runtime);
+    }
+
+    void schedulerSifDmaResume(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_sifDmaResult = getRegS32(*ctx, 2);
+        ctx->pc = 0u;
+        runtime->requestStop();
+    }
 }
 
 void register_ps2_sif_dma_tests()
@@ -205,30 +235,18 @@ void register_ps2_sif_dma_tests()
         {
             TestEnv env;
 
-            constexpr uint32_t kDescAddr = 0x00020300u;
             constexpr uint32_t kSrcAddr = 0x00020400u;
             constexpr uint32_t kDstAddr = 0x00020500u;
-            constexpr uint32_t kHandlerAddr = 0x00100000u;
             constexpr uint32_t kHandlerWriteAddr = 0x00020600u;
-            constexpr uint32_t kHandlerArg = 0x12345678u;
 
             g_dmacHandlerWriteAddr = kHandlerWriteAddr;
             g_dmacHandlerValue = 0xCAFEBABEu;
             g_dmacHandlerLastCause = 0u;
             g_dmacHandlerLastArg = 0u;
-            env.runtime.registerFunction(kHandlerAddr, &testDmacHandler);
-
-            setRegU32(env.ctx, 4, 5u);
-            setRegU32(env.ctx, 5, kHandlerAddr);
-            setRegU32(env.ctx, 6, 0u);
-            setRegU32(env.ctx, 7, kHandlerArg);
-            ps2_syscalls::AddDmacHandler(env.rdram.data(), &env.ctx, &env.runtime);
-            const int32_t handlerId = getRegS32(env.ctx, 2);
-            t.IsTrue(handlerId > 0, "AddDmacHandler should register a handler");
-
-            setRegU32(env.ctx, 4, 5u);
-            ps2_syscalls::EnableDmac(env.rdram.data(), &env.ctx, &env.runtime);
-            t.Equals(getRegS32(env.ctx, 2), 0, "EnableDmac should succeed");
+            g_sifDmaResult = 0;
+            env.runtime.registerFunction(kSchedulerSifDmaEntryPc, schedulerSifDmaEntry);
+            env.runtime.registerFunction(kSchedulerSifDmaResumePc, schedulerSifDmaResume);
+            env.runtime.registerFunction(kSchedulerSifDmaHandlerPc, testDmacHandler);
 
             std::array<uint8_t, 16> payload{};
             for (size_t i = 0; i < payload.size(); ++i)
@@ -242,17 +260,19 @@ void register_ps2_sif_dma_tests()
                 kDstAddr,
                 static_cast<int32_t>(payload.size()),
                 0};
-            std::memcpy(env.rdram.data() + kDescAddr, &desc, sizeof(desc));
+            std::memcpy(env.rdram.data() + kSchedulerSifDmaDescAddr, &desc, sizeof(desc));
 
-            setRegU32(env.ctx, 4, kDescAddr);
-            setRegU32(env.ctx, 5, 1u);
-            ps2_stubs::sceSifSetDma(env.rdram.data(), &env.ctx, &env.runtime);
+            R5900Context mainContext{};
+            mainContext.pc = kSchedulerSifDmaEntryPc;
+            env.runtime.eeScheduler().reset(env.rdram.data(), mainContext);
+            env.runtime.eeScheduler().run();
 
-            t.IsTrue(getRegS32(env.ctx, 2) > 0, "sceSifSetDma should still report success");
+            t.IsTrue(g_sifDmaResult > 0, "sceSifSetDma should still report success");
             t.Equals(readGuestU32(env.rdram.data(), kHandlerWriteAddr), g_dmacHandlerValue,
-                     "sceSifSetDma should invoke registered DMAC handlers");
+                     "the scheduler should execute the queued DMAC invocation");
             t.Equals(g_dmacHandlerLastCause, 5u, "DMAC handler should observe cause 5");
-            t.Equals(g_dmacHandlerLastArg, kHandlerArg, "DMAC handler should receive registered argument");
+            t.Equals(g_dmacHandlerLastArg, kSchedulerSifDmaHandlerArg,
+                     "DMAC handler should receive registered argument");
         });
 
         tc.Run("sceSifSetDma acknowledges DTX work-buffer transfers by advancing the EE footer ticket", [](TestCase &t)

ps2xTest/src/ps2_sif_rpc_tests.cpp

@@ -1,8 +1,10 @@
 #include "MiniTest.h"
 #include "ps2_runtime.h"
+#include "ps2_runtime_macros.h"
 #include "ps2_iop_transport.h"
 #include "ps2_syscalls.h"
 #include "ps2_stubs.h"
+#include "runtime/ee_scheduler.h"
 
 #include <array>
 #include <atomic>
@@ -161,6 +163,13 @@ namespace
 
     constexpr uint32_t K_DTX_DISPATCH_RESULT_ADDR = 0x0002D800u;
     constexpr uint32_t K_DTX_DISPATCH_RESULT_MARKER = 0xD15CA7C1u;
+    constexpr uint32_t K_DTX_SCHEDULER_CALL = 0x00102000u;
+    constexpr uint32_t K_DTX_SCHEDULER_RESUME = 0x00102010u;
+    uint32_t g_schedulerRpcClient = 0u;
+    uint32_t g_schedulerRpcNumber = 0u;
+    uint32_t g_schedulerRpcSend = 0u;
+    uint32_t g_schedulerRpcReceive = 0u;
+    uint32_t g_schedulerRpcResult = 0u;
 
     void lotrSoundEndCallbackShouldNotRun(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
@@ -178,6 +187,27 @@ namespace
         ctx->pc = ::getRegU32(ctx, 31);
     }
 
+    void schedulerDtxRpcCall(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        SET_GPR_U32(ctx, 4, g_schedulerRpcClient);
+        SET_GPR_U32(ctx, 5, g_schedulerRpcNumber);
+        SET_GPR_U32(ctx, 6, 0u);
+        SET_GPR_U32(ctx, 7, g_schedulerRpcSend);
+        SET_GPR_U32(ctx, 8, 8u);
+        SET_GPR_U32(ctx, 9, g_schedulerRpcReceive);
+        SET_GPR_U32(ctx, 10, sizeof(uint32_t));
+        SET_GPR_U32(ctx, 11, 0u);
+        ctx->pc = K_DTX_SCHEDULER_RESUME;
+        SifCallRpc(rdram, ctx, runtime);
+    }
+
+    void schedulerDtxRpcResume(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_schedulerRpcResult = ::getRegU32(ctx, 2);
+        ctx->pc = 0u;
+        runtime->requestStop();
+    }
+
     void recvxDtxDispatcher(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         (void)runtime;
@@ -1156,7 +1186,22 @@ void register_ps2_sif_rpc_tests()
 
             writeGuestU32(env.rdram.data(), kFnTableSlot, kRegisteredHandlerAddr);
             writeGuestU32(env.rdram.data(), kRecvAddr, 0u);
-            callUrpc();
+            env.runtime.registerFunction(K_DTX_SCHEDULER_CALL, schedulerDtxRpcCall);
+            env.runtime.registerFunction(K_DTX_SCHEDULER_RESUME, schedulerDtxRpcResume);
+            g_schedulerRpcClient = kClientAddr;
+            g_schedulerRpcNumber = kRpcNum;
+            g_schedulerRpcSend = kSendAddr;
+            g_schedulerRpcReceive = kRecvAddr;
+            g_schedulerRpcResult = static_cast<uint32_t>(-1);
+            R5900Context mainContext{};
+            mainContext.pc = K_DTX_SCHEDULER_CALL;
+            setRegU32(mainContext, 29, K_STACK_ADDR);
+            writeGuestU32(env.rdram.data(), K_STACK_ADDR + 0x00u, 0u);
+            env.runtime.eeScheduler().reset(env.rdram.data(), mainContext);
+            env.runtime.eeScheduler().run();
+
+            t.Equals(g_schedulerRpcResult, static_cast<uint32_t>(KE_OK),
+                     "DTX URPC should resume its base context with KE_OK");
 
             t.Equals(g_dtxDispatcherHits.load(), 1u,
                      "registered DTX function-table slot should enter the guest dispatcher");