172 files changed, 6924 insertions, 2706 deletions

diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index 5db6a1b3a..b681d21a7 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -13,6 +13,8 @@ add_library(core STATIC
     arm/dynarmic/arm_exclusive_monitor.h
     arm/exclusive_monitor.cpp
     arm/exclusive_monitor.h
+    arm/symbols.cpp
+    arm/symbols.h
     constants.cpp
     constants.h
     core.cpp
@@ -122,6 +124,8 @@ add_library(core STATIC
     frontend/applets/error.h
     frontend/applets/general_frontend.cpp
     frontend/applets/general_frontend.h
+    frontend/applets/mii_edit.cpp
+    frontend/applets/mii_edit.h
     frontend/applets/profile_select.cpp
     frontend/applets/profile_select.h
     frontend/applets/software_keyboard.cpp
@@ -207,6 +211,8 @@ add_library(core STATIC
     hle/kernel/k_memory_region.h
     hle/kernel/k_memory_region_type.h
     hle/kernel/k_page_bitmap.h
+    hle/kernel/k_page_buffer.cpp
+    hle/kernel/k_page_buffer.h
     hle/kernel/k_page_heap.cpp
     hle/kernel/k_page_heap.h
     hle/kernel/k_page_linked_list.h
@@ -244,6 +250,8 @@ add_library(core STATIC
     hle/kernel/k_system_control.h
     hle/kernel/k_thread.cpp
     hle/kernel/k_thread.h
+    hle/kernel/k_thread_local_page.cpp
+    hle/kernel/k_thread_local_page.h
     hle/kernel/k_thread_queue.cpp
     hle/kernel/k_thread_queue.h
     hle/kernel/k_trace.h
@@ -300,6 +308,9 @@ add_library(core STATIC
     hle/service/am/applets/applet_error.h
     hle/service/am/applets/applet_general_backend.cpp
     hle/service/am/applets/applet_general_backend.h
+    hle/service/am/applets/applet_mii_edit.cpp
+    hle/service/am/applets/applet_mii_edit.h
+    hle/service/am/applets/applet_mii_edit_types.h
     hle/service/am/applets/applet_profile_select.cpp
     hle/service/am/applets/applet_profile_select.h
     hle/service/am/applets/applet_software_keyboard.cpp
@@ -449,6 +460,10 @@ add_library(core STATIC
     hle/service/hid/controllers/touchscreen.h
     hle/service/hid/controllers/xpad.cpp
     hle/service/hid/controllers/xpad.h
+    hle/service/jit/jit_context.cpp
+    hle/service/jit/jit_context.h
+    hle/service/jit/jit.cpp
+    hle/service/jit/jit.h
     hle/service/lbl/lbl.cpp
     hle/service/lbl/lbl.h
     hle/service/ldn/errors.h
@@ -526,10 +541,35 @@ add_library(core STATIC
     hle/service/nvdrv/nvmemp.h
     hle/service/nvdrv/syncpoint_manager.cpp
     hle/service/nvdrv/syncpoint_manager.h
-    hle/service/nvflinger/buffer_queue.cpp
-    hle/service/nvflinger/buffer_queue.h
+    hle/service/nvflinger/binder.h
+    hle/service/nvflinger/buffer_item.h
+    hle/service/nvflinger/buffer_item_consumer.cpp
+    hle/service/nvflinger/buffer_item_consumer.h
+    hle/service/nvflinger/buffer_queue_consumer.cpp
+    hle/service/nvflinger/buffer_queue_consumer.h
+    hle/service/nvflinger/buffer_queue_core.cpp
+    hle/service/nvflinger/buffer_queue_core.h
+    hle/service/nvflinger/buffer_queue_defs.h
+    hle/service/nvflinger/buffer_queue_producer.cpp
+    hle/service/nvflinger/buffer_queue_producer.h
+    hle/service/nvflinger/buffer_slot.h
+    hle/service/nvflinger/buffer_transform_flags.h
+    hle/service/nvflinger/consumer_base.cpp
+    hle/service/nvflinger/consumer_base.h
+    hle/service/nvflinger/consumer_listener.h
+    hle/service/nvflinger/graphic_buffer_producer.cpp
+    hle/service/nvflinger/graphic_buffer_producer.h
+    hle/service/nvflinger/hos_binder_driver_server.cpp
+    hle/service/nvflinger/hos_binder_driver_server.h
     hle/service/nvflinger/nvflinger.cpp
     hle/service/nvflinger/nvflinger.h
+    hle/service/nvflinger/parcel.h
+    hle/service/nvflinger/pixel_format.h
+    hle/service/nvflinger/producer_listener.h
+    hle/service/nvflinger/status.h
+    hle/service/nvflinger/ui/fence.h
+    hle/service/nvflinger/ui/graphic_buffer.h
+    hle/service/nvflinger/window.h
     hle/service/olsc/olsc.cpp
     hle/service/olsc/olsc.h
     hle/service/pcie/pcie.cpp
diff --git a/src/core/arm/arm_interface.cpp b/src/core/arm/arm_interface.cpp
index 0951e1976..08bf1201d 100644
--- a/src/core/arm/arm_interface.cpp
+++ b/src/core/arm/arm_interface.cpp
@@ -8,134 +8,13 @@
 #include "common/common_types.h"
 #include "common/logging/log.h"
 #include "core/arm/arm_interface.h"
+#include "core/arm/symbols.h"
 #include "core/core.h"
+#include "core/hle/kernel/k_process.h"
 #include "core/loader/loader.h"
 #include "core/memory.h"
 
 namespace Core {
-namespace {
-
-constexpr u64 ELF_DYNAMIC_TAG_NULL = 0;
-constexpr u64 ELF_DYNAMIC_TAG_STRTAB = 5;
-constexpr u64 ELF_DYNAMIC_TAG_SYMTAB = 6;
-constexpr u64 ELF_DYNAMIC_TAG_SYMENT = 11;
-
-enum class ELFSymbolType : u8 {
-    None = 0,
-    Object = 1,
-    Function = 2,
-    Section = 3,
-    File = 4,
-    Common = 5,
-    TLS = 6,
-};
-
-enum class ELFSymbolBinding : u8 {
-    Local = 0,
-    Global = 1,
-    Weak = 2,
-};
-
-enum class ELFSymbolVisibility : u8 {
-    Default = 0,
-    Internal = 1,
-    Hidden = 2,
-    Protected = 3,
-};
-
-struct ELFSymbol {
-    u32 name_index;
-    union {
-        u8 info;
-
-        BitField<0, 4, ELFSymbolType> type;
-        BitField<4, 4, ELFSymbolBinding> binding;
-    };
-    ELFSymbolVisibility visibility;
-    u16 sh_index;
-    u64 value;
-    u64 size;
-};
-static_assert(sizeof(ELFSymbol) == 0x18, "ELFSymbol has incorrect size.");
-
-using Symbols = std::vector<std::pair<ELFSymbol, std::string>>;
-
-Symbols GetSymbols(VAddr text_offset, Core::Memory::Memory& memory) {
-    const auto mod_offset = text_offset + memory.Read32(text_offset + 4);
-
-    if (mod_offset < text_offset || (mod_offset & 0b11) != 0 ||
-        memory.Read32(mod_offset) != Common::MakeMagic('M', 'O', 'D', '0')) {
-        return {};
-    }
-
-    const auto dynamic_offset = memory.Read32(mod_offset + 0x4) + mod_offset;
-
-    VAddr string_table_offset{};
-    VAddr symbol_table_offset{};
-    u64 symbol_entry_size{};
-
-    VAddr dynamic_index = dynamic_offset;
-    while (true) {
-        const u64 tag = memory.Read64(dynamic_index);
-        const u64 value = memory.Read64(dynamic_index + 0x8);
-        dynamic_index += 0x10;
-
-        if (tag == ELF_DYNAMIC_TAG_NULL) {
-            break;
-        }
-
-        if (tag == ELF_DYNAMIC_TAG_STRTAB) {
-            string_table_offset = value;
-        } else if (tag == ELF_DYNAMIC_TAG_SYMTAB) {
-            symbol_table_offset = value;
-        } else if (tag == ELF_DYNAMIC_TAG_SYMENT) {
-            symbol_entry_size = value;
-        }
-    }
-
-    if (string_table_offset == 0 || symbol_table_offset == 0 || symbol_entry_size == 0) {
-        return {};
-    }
-
-    const auto string_table_address = text_offset + string_table_offset;
-    const auto symbol_table_address = text_offset + symbol_table_offset;
-
-    Symbols out;
-
-    VAddr symbol_index = symbol_table_address;
-    while (symbol_index < string_table_address) {
-        ELFSymbol symbol{};
-        memory.ReadBlock(symbol_index, &symbol, sizeof(ELFSymbol));
-
-        VAddr string_offset = string_table_address + symbol.name_index;
-        std::string name;
-        for (u8 c = memory.Read8(string_offset); c != 0; c = memory.Read8(++string_offset)) {
-            name += static_cast<char>(c);
-        }
-
-        symbol_index += symbol_entry_size;
-        out.push_back({symbol, name});
-    }
-
-    return out;
-}
-
-std::optional<std::string> GetSymbolName(const Symbols& symbols, VAddr func_address) {
-    const auto iter =
-        std::find_if(symbols.begin(), symbols.end(), [func_address](const auto& pair) {
-            const auto& symbol = pair.first;
-            const auto end_address = symbol.value + symbol.size;
-            return func_address >= symbol.value && func_address < end_address;
-        });
-
-    if (iter == symbols.end()) {
-        return std::nullopt;
-    }
-
-    return iter->second;
-}
-
-} // Anonymous namespace
 
 constexpr u64 SEGMENT_BASE = 0x7100000000ull;
 
@@ -169,9 +48,11 @@ std::vector<ARM_Interface::BacktraceEntry> ARM_Interface::GetBacktraceFromContex
         return {};
     }
 
-    std::map<std::string, Symbols> symbols;
+    std::map<std::string, Symbols::Symbols> symbols;
     for (const auto& module : modules) {
-        symbols.insert_or_assign(module.second, GetSymbols(module.first, memory));
+        symbols.insert_or_assign(module.second,
+                                 Symbols::GetSymbols(module.first, system.Memory(),
+                                                     system.CurrentProcess()->Is64BitProcess()));
     }
 
     for (auto& entry : out) {
@@ -193,7 +74,7 @@ std::vector<ARM_Interface::BacktraceEntry> ARM_Interface::GetBacktraceFromContex
 
         const auto symbol_set = symbols.find(entry.module);
         if (symbol_set != symbols.end()) {
-            const auto symbol = GetSymbolName(symbol_set->second, entry.offset);
+            const auto symbol = Symbols::GetSymbolName(symbol_set->second, entry.offset);
             if (symbol.has_value()) {
                 // TODO(DarkLordZach): Add demangling of symbol names.
                 entry.name = *symbol;
@@ -225,9 +106,11 @@ std::vector<ARM_Interface::BacktraceEntry> ARM_Interface::GetBacktrace() const {
         return {};
     }
 
-    std::map<std::string, Symbols> symbols;
+    std::map<std::string, Symbols::Symbols> symbols;
     for (const auto& module : modules) {
-        symbols.insert_or_assign(module.second, GetSymbols(module.first, memory));
+        symbols.insert_or_assign(module.second,
+                                 Symbols::GetSymbols(module.first, system.Memory(),
+                                                     system.CurrentProcess()->Is64BitProcess()));
     }
 
     for (auto& entry : out) {
@@ -249,7 +132,7 @@ std::vector<ARM_Interface::BacktraceEntry> ARM_Interface::GetBacktrace() const {
 
         const auto symbol_set = symbols.find(entry.module);
         if (symbol_set != symbols.end()) {
-            const auto symbol = GetSymbolName(symbol_set->second, entry.offset);
+            const auto symbol = Symbols::GetSymbolName(symbol_set->second, entry.offset);
             if (symbol.has_value()) {
                 // TODO(DarkLordZach): Add demangling of symbol names.
                 entry.name = *symbol;
diff --git a/src/core/arm/arm_interface.h b/src/core/arm/arm_interface.h
index c60322442..dce2f4195 100644
--- a/src/core/arm/arm_interface.h
+++ b/src/core/arm/arm_interface.h
@@ -171,6 +171,9 @@ public:
     /// Prepare core for thread reschedule (if needed to correctly handle state)
     virtual void PrepareReschedule() = 0;
 
+    /// Signal an interrupt and ask the core to halt as soon as possible.
+    virtual void SignalInterrupt() = 0;
+
     struct BacktraceEntry {
         std::string module;
         u64 address;
diff --git a/src/core/arm/dynarmic/arm_dynarmic_32.cpp b/src/core/arm/dynarmic/arm_dynarmic_32.cpp
index c1c843b8f..6f3d53dad 100644
--- a/src/core/arm/dynarmic/arm_dynarmic_32.cpp
+++ b/src/core/arm/dynarmic/arm_dynarmic_32.cpp
@@ -25,6 +25,9 @@ namespace Core {
 
 using namespace Common::Literals;
 
+constexpr Dynarmic::HaltReason break_loop = Dynarmic::HaltReason::UserDefined2;
+constexpr Dynarmic::HaltReason svc_call = Dynarmic::HaltReason::UserDefined3;
+
 class DynarmicCallbacks32 : public Dynarmic::A32::UserCallbacks {
 public:
     explicit DynarmicCallbacks32(ARM_Dynarmic_32& parent_)
@@ -70,11 +73,13 @@ public:
     }
 
     void InterpreterFallback(u32 pc, std::size_t num_instructions) override {
+        parent.LogBacktrace();
         UNIMPLEMENTED_MSG("This should never happen, pc = {:08X}, code = {:08X}", pc,
                           MemoryReadCode(pc));
     }
 
     void ExceptionRaised(u32 pc, Dynarmic::A32::Exception exception) override {
+        parent.LogBacktrace();
         LOG_CRITICAL(Core_ARM,
                      "ExceptionRaised(exception = {}, pc = {:08X}, code = {:08X}, thumb = {})",
                      exception, pc, MemoryReadCode(pc), parent.IsInThumbMode());
@@ -82,15 +87,13 @@ public:
     }
 
     void CallSVC(u32 swi) override {
-        parent.svc_called = true;
         parent.svc_swi = swi;
-        parent.jit->HaltExecution();
+        parent.jit->HaltExecution(svc_call);
     }
 
     void AddTicks(u64 ticks) override {
-        if (parent.uses_wall_clock) {
-            return;
-        }
+        ASSERT_MSG(!parent.uses_wall_clock, "This should never happen - dynarmic ticking disabled");
+
         // Divide the number of ticks by the amount of CPU cores. TODO(Subv): This yields only a
         // rough approximation of the amount of executed ticks in the system, it may be thrown off
         // if not all cores are doing a similar amount of work. Instead of doing this, we should
@@ -106,12 +109,8 @@ public:
     }
 
     u64 GetTicksRemaining() override {
-        if (parent.uses_wall_clock) {
-            if (!parent.interrupt_handlers[parent.core_index].IsInterrupted()) {
-                return minimum_run_cycles;
-            }
-            return 0U;
-        }
+        ASSERT_MSG(!parent.uses_wall_clock, "This should never happen - dynarmic ticking disabled");
+
         return std::max<s64>(parent.system.CoreTiming().GetDowncount(), 0);
     }
 
@@ -146,10 +145,11 @@ std::shared_ptr<Dynarmic::A32::Jit> ARM_Dynarmic_32::MakeJit(Common::PageTable*
 
     // Timing
     config.wall_clock_cntpct = uses_wall_clock;
+    config.enable_cycle_counting = !uses_wall_clock;
 
     // Code cache size
-    config.code_cache_size = 128_MiB;
-    config.far_code_offset = 100_MiB;
+    config.code_cache_size = 512_MiB;
+    config.far_code_offset = 400_MiB;
 
     // Safe optimizations
     if (Settings::values.cpu_debug_mode) {
@@ -186,35 +186,41 @@ std::shared_ptr<Dynarmic::A32::Jit> ARM_Dynarmic_32::MakeJit(Common::PageTable*
         if (!Settings::values.cpuopt_recompile_exclusives) {
             config.recompile_on_exclusive_fastmem_failure = false;
         }
-    }
+    } else {
+        // Unsafe optimizations
+        if (Settings::values.cpu_accuracy.GetValue() == Settings::CPUAccuracy::Unsafe) {
+            config.unsafe_optimizations = true;
+            if (Settings::values.cpuopt_unsafe_unfuse_fma) {
+                config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_UnfuseFMA;
+            }
+            if (Settings::values.cpuopt_unsafe_reduce_fp_error) {
+                config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_ReducedErrorFP;
+            }
+            if (Settings::values.cpuopt_unsafe_ignore_standard_fpcr) {
+                config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_IgnoreStandardFPCRValue;
+            }
+            if (Settings::values.cpuopt_unsafe_inaccurate_nan) {
+                config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_InaccurateNaN;
+            }
+            if (Settings::values.cpuopt_unsafe_ignore_global_monitor) {
+                config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_IgnoreGlobalMonitor;
+            }
+        }
 
-    // Unsafe optimizations
-    if (Settings::values.cpu_accuracy.GetValue() == Settings::CPUAccuracy::Unsafe) {
-        config.unsafe_optimizations = true;
-        if (Settings::values.cpuopt_unsafe_unfuse_fma) {
+        // Curated optimizations
+        if (Settings::values.cpu_accuracy.GetValue() == Settings::CPUAccuracy::Auto) {
+            config.unsafe_optimizations = true;
             config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_UnfuseFMA;
-        }
-        if (Settings::values.cpuopt_unsafe_reduce_fp_error) {
-            config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_ReducedErrorFP;
-        }
-        if (Settings::values.cpuopt_unsafe_ignore_standard_fpcr) {
             config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_IgnoreStandardFPCRValue;
-        }
-        if (Settings::values.cpuopt_unsafe_inaccurate_nan) {
             config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_InaccurateNaN;
-        }
-        if (Settings::values.cpuopt_unsafe_ignore_global_monitor) {
             config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_IgnoreGlobalMonitor;
         }
-    }
 
-    // Curated optimizations
-    if (Settings::values.cpu_accuracy.GetValue() == Settings::CPUAccuracy::Auto) {
-        config.unsafe_optimizations = true;
-        config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_UnfuseFMA;
-        config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_IgnoreStandardFPCRValue;
-        config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_InaccurateNaN;
-        config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_IgnoreGlobalMonitor;
+        // Paranoia mode for debugging optimizations
+        if (Settings::values.cpu_accuracy.GetValue() == Settings::CPUAccuracy::Paranoid) {
+            config.unsafe_optimizations = false;
+            config.optimizations = Dynarmic::no_optimizations;
+        }
     }
 
     return std::make_unique<Dynarmic::A32::Jit>(config);
@@ -222,13 +228,11 @@ std::shared_ptr<Dynarmic::A32::Jit> ARM_Dynarmic_32::MakeJit(Common::PageTable*
 
 void ARM_Dynarmic_32::Run() {
     while (true) {
-        jit->Run();
-        if (!svc_called) {
-            break;
+        const auto hr = jit->Run();
+        if (Has(hr, svc_call)) {
+            Kernel::Svc::Call(system, svc_swi);
         }
-        svc_called = false;
-        Kernel::Svc::Call(system, svc_swi);
-        if (shutdown) {
+        if (Has(hr, break_loop) || !uses_wall_clock) {
             break;
         }
     }
@@ -314,8 +318,11 @@ void ARM_Dynarmic_32::LoadContext(const ThreadContext32& ctx) {
 }
 
 void ARM_Dynarmic_32::PrepareReschedule() {
-    jit->HaltExecution();
-    shutdown = true;
+    jit->HaltExecution(break_loop);
+}
+
+void ARM_Dynarmic_32::SignalInterrupt() {
+    jit->HaltExecution(break_loop);
 }
 
 void ARM_Dynarmic_32::ClearInstructionCache() {
diff --git a/src/core/arm/dynarmic/arm_dynarmic_32.h b/src/core/arm/dynarmic/arm_dynarmic_32.h
index 5d47b600d..3f68a4ff1 100644
--- a/src/core/arm/dynarmic/arm_dynarmic_32.h
+++ b/src/core/arm/dynarmic/arm_dynarmic_32.h
@@ -57,6 +57,7 @@ public:
     void LoadContext(const ThreadContext64& ctx) override {}
 
     void PrepareReschedule() override;
+    void SignalInterrupt() override;
     void ClearExclusiveState() override;
 
     void ClearInstructionCache() override;
@@ -83,9 +84,6 @@ private:
 
     // SVC callback
     u32 svc_swi{};
-    bool svc_called{};
-
-    bool shutdown{};
 };
 
 } // namespace Core
diff --git a/src/core/arm/dynarmic/arm_dynarmic_64.cpp b/src/core/arm/dynarmic/arm_dynarmic_64.cpp
index aa74fce4d..1fcb2b891 100644
--- a/src/core/arm/dynarmic/arm_dynarmic_64.cpp
+++ b/src/core/arm/dynarmic/arm_dynarmic_64.cpp
@@ -26,6 +26,9 @@ namespace Core {
 using Vector = Dynarmic::A64::Vector;
 using namespace Common::Literals;
 
+constexpr Dynarmic::HaltReason break_loop = Dynarmic::HaltReason::UserDefined2;
+constexpr Dynarmic::HaltReason svc_call = Dynarmic::HaltReason::UserDefined3;
+
 class DynarmicCallbacks64 : public Dynarmic::A64::UserCallbacks {
 public:
     explicit DynarmicCallbacks64(ARM_Dynarmic_64& parent_)
@@ -81,6 +84,7 @@ public:
     }
 
     void InterpreterFallback(u64 pc, std::size_t num_instructions) override {
+        parent.LogBacktrace();
         LOG_ERROR(Core_ARM,
                   "Unimplemented instruction @ 0x{:X} for {} instructions (instr = {:08X})", pc,
                   num_instructions, MemoryReadCode(pc));
@@ -93,17 +97,19 @@ public:
             static constexpr u64 ICACHE_LINE_SIZE = 64;
 
             const u64 cache_line_start = value & ~(ICACHE_LINE_SIZE - 1);
-            parent.InvalidateCacheRange(cache_line_start, ICACHE_LINE_SIZE);
+            parent.system.InvalidateCpuInstructionCacheRange(cache_line_start, ICACHE_LINE_SIZE);
             break;
         }
         case Dynarmic::A64::InstructionCacheOperation::InvalidateAllToPoU:
-            parent.ClearInstructionCache();
+            parent.system.InvalidateCpuInstructionCaches();
             break;
         case Dynarmic::A64::InstructionCacheOperation::InvalidateAllToPoUInnerSharable:
         default:
             LOG_DEBUG(Core_ARM, "Unprocesseed instruction cache operation: {}", op);
             break;
         }
+
+        parent.jit->HaltExecution(Dynarmic::HaltReason::CacheInvalidation);
     }
 
     void ExceptionRaised(u64 pc, Dynarmic::A64::Exception exception) override {
@@ -116,21 +122,19 @@ public:
             return;
         case Dynarmic::A64::Exception::Breakpoint:
         default:
+            parent.LogBacktrace();
             ASSERT_MSG(false, "ExceptionRaised(exception = {}, pc = {:08X}, code = {:08X})",
                        static_cast<std::size_t>(exception), pc, MemoryReadCode(pc));
         }
     }
 
     void CallSVC(u32 swi) override {
-        parent.svc_called = true;
         parent.svc_swi = swi;
-        parent.jit->HaltExecution();
+        parent.jit->HaltExecution(svc_call);
     }
 
     void AddTicks(u64 ticks) override {
-        if (parent.uses_wall_clock) {
-            return;
-        }
+        ASSERT_MSG(!parent.uses_wall_clock, "This should never happen - dynarmic ticking disabled");
 
         // Divide the number of ticks by the amount of CPU cores. TODO(Subv): This yields only a
         // rough approximation of the amount of executed ticks in the system, it may be thrown off
@@ -145,12 +149,8 @@ public:
     }
 
     u64 GetTicksRemaining() override {
-        if (parent.uses_wall_clock) {
-            if (!parent.interrupt_handlers[parent.core_index].IsInterrupted()) {
-                return minimum_run_cycles;
-            }
-            return 0U;
-        }
+        ASSERT_MSG(!parent.uses_wall_clock, "This should never happen - dynarmic ticking disabled");
+
         return std::max<s64>(parent.system.CoreTiming().GetDowncount(), 0);
     }
 
@@ -206,10 +206,11 @@ std::shared_ptr<Dynarmic::A64::Jit> ARM_Dynarmic_64::MakeJit(Common::PageTable*
 
     // Timing
     config.wall_clock_cntpct = uses_wall_clock;
+    config.enable_cycle_counting = !uses_wall_clock;
 
     // Code cache size
-    config.code_cache_size = 128_MiB;
-    config.far_code_offset = 100_MiB;
+    config.code_cache_size = 512_MiB;
+    config.far_code_offset = 400_MiB;
 
     // Safe optimizations
     if (Settings::values.cpu_debug_mode) {
@@ -246,35 +247,41 @@ std::shared_ptr<Dynarmic::A64::Jit> ARM_Dynarmic_64::MakeJit(Common::PageTable*
         if (!Settings::values.cpuopt_recompile_exclusives) {
             config.recompile_on_exclusive_fastmem_failure = false;
         }
-    }
+    } else {
+        // Unsafe optimizations
+        if (Settings::values.cpu_accuracy.GetValue() == Settings::CPUAccuracy::Unsafe) {
+            config.unsafe_optimizations = true;
+            if (Settings::values.cpuopt_unsafe_unfuse_fma) {
+                config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_UnfuseFMA;
+            }
+            if (Settings::values.cpuopt_unsafe_reduce_fp_error) {
+                config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_ReducedErrorFP;
+            }
+            if (Settings::values.cpuopt_unsafe_inaccurate_nan) {
+                config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_InaccurateNaN;
+            }
+            if (Settings::values.cpuopt_unsafe_fastmem_check) {
+                config.fastmem_address_space_bits = 64;
+            }
+            if (Settings::values.cpuopt_unsafe_ignore_global_monitor) {
+                config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_IgnoreGlobalMonitor;
+            }
+        }
 
-    // Unsafe optimizations
-    if (Settings::values.cpu_accuracy.GetValue() == Settings::CPUAccuracy::Unsafe) {
-        config.unsafe_optimizations = true;
-        if (Settings::values.cpuopt_unsafe_unfuse_fma) {
+        // Curated optimizations
+        if (Settings::values.cpu_accuracy.GetValue() == Settings::CPUAccuracy::Auto) {
+            config.unsafe_optimizations = true;
             config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_UnfuseFMA;
-        }
-        if (Settings::values.cpuopt_unsafe_reduce_fp_error) {
-            config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_ReducedErrorFP;
-        }
-        if (Settings::values.cpuopt_unsafe_inaccurate_nan) {
             config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_InaccurateNaN;
-        }
-        if (Settings::values.cpuopt_unsafe_fastmem_check) {
             config.fastmem_address_space_bits = 64;
-        }
-        if (Settings::values.cpuopt_unsafe_ignore_global_monitor) {
             config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_IgnoreGlobalMonitor;
         }
-    }
 
-    // Curated optimizations
-    if (Settings::values.cpu_accuracy.GetValue() == Settings::CPUAccuracy::Auto) {
-        config.unsafe_optimizations = true;
-        config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_UnfuseFMA;
-        config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_InaccurateNaN;
-        config.fastmem_address_space_bits = 64;
-        config.optimizations |= Dynarmic::OptimizationFlag::Unsafe_IgnoreGlobalMonitor;
+        // Paranoia mode for debugging optimizations
+        if (Settings::values.cpu_accuracy.GetValue() == Settings::CPUAccuracy::Paranoid) {
+            config.unsafe_optimizations = false;
+            config.optimizations = Dynarmic::no_optimizations;
+        }
     }
 
     return std::make_shared<Dynarmic::A64::Jit>(config);
@@ -282,13 +289,11 @@ std::shared_ptr<Dynarmic::A64::Jit> ARM_Dynarmic_64::MakeJit(Common::PageTable*
 
 void ARM_Dynarmic_64::Run() {
     while (true) {
-        jit->Run();
-        if (!svc_called) {
-            break;
+        const auto hr = jit->Run();
+        if (Has(hr, svc_call)) {
+            Kernel::Svc::Call(system, svc_swi);
         }
-        svc_called = false;
-        Kernel::Svc::Call(system, svc_swi);
-        if (shutdown) {
+        if (Has(hr, break_loop) || !uses_wall_clock) {
             break;
         }
     }
@@ -379,8 +384,11 @@ void ARM_Dynarmic_64::LoadContext(const ThreadContext64& ctx) {
 }
 
 void ARM_Dynarmic_64::PrepareReschedule() {
-    jit->HaltExecution();
-    shutdown = true;
+    jit->HaltExecution(break_loop);
+}
+
+void ARM_Dynarmic_64::SignalInterrupt() {
+    jit->HaltExecution(break_loop);
 }
 
 void ARM_Dynarmic_64::ClearInstructionCache() {
diff --git a/src/core/arm/dynarmic/arm_dynarmic_64.h b/src/core/arm/dynarmic/arm_dynarmic_64.h
index 0c4e46c64..58bc7fbec 100644
--- a/src/core/arm/dynarmic/arm_dynarmic_64.h
+++ b/src/core/arm/dynarmic/arm_dynarmic_64.h
@@ -51,6 +51,7 @@ public:
     void LoadContext(const ThreadContext64& ctx) override;
 
     void PrepareReschedule() override;
+    void SignalInterrupt() override;
     void ClearExclusiveState() override;
 
     void ClearInstructionCache() override;
@@ -77,9 +78,6 @@ private:
 
     // SVC callback
     u32 svc_swi{};
-    bool svc_called{};
-
-    bool shutdown{};
 };
 
 } // namespace Core
diff --git a/src/core/arm/dynarmic/arm_exclusive_monitor.h b/src/core/arm/dynarmic/arm_exclusive_monitor.h
index 5a15b43ef..b82c77f76 100644
--- a/src/core/arm/dynarmic/arm_exclusive_monitor.h
+++ b/src/core/arm/dynarmic/arm_exclusive_monitor.h
@@ -4,8 +4,6 @@
 
 #pragma once
 
-#include <unordered_map>
-
 #include <dynarmic/interface/exclusive_monitor.h>
 
 #include "common/common_types.h"
diff --git a/src/core/arm/symbols.cpp b/src/core/arm/symbols.cpp
new file mode 100644
index 000000000..26c44f0c7
--- /dev/null
+++ b/src/core/arm/symbols.cpp
@@ -0,0 +1,190 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#include "common/bit_field.h"
+#include "common/common_funcs.h"
+#include "core/arm/symbols.h"
+#include "core/core.h"
+#include "core/memory.h"
+
+namespace Core {
+namespace {
+
+constexpr u64 ELF_DYNAMIC_TAG_NULL = 0;
+constexpr u64 ELF_DYNAMIC_TAG_STRTAB = 5;
+constexpr u64 ELF_DYNAMIC_TAG_SYMTAB = 6;
+constexpr u64 ELF_DYNAMIC_TAG_SYMENT = 11;
+
+enum class ELFSymbolType : u8 {
+    None = 0,
+    Object = 1,
+    Function = 2,
+    Section = 3,
+    File = 4,
+    Common = 5,
+    TLS = 6,
+};
+
+enum class ELFSymbolBinding : u8 {
+    Local = 0,
+    Global = 1,
+    Weak = 2,
+};
+
+enum class ELFSymbolVisibility : u8 {
+    Default = 0,
+    Internal = 1,
+    Hidden = 2,
+    Protected = 3,
+};
+
+struct ELF64Symbol {
+    u32 name_index;
+    union {
+        u8 info;
+
+        BitField<0, 4, ELFSymbolType> type;
+        BitField<4, 4, ELFSymbolBinding> binding;
+    };
+    ELFSymbolVisibility visibility;
+    u16 sh_index;
+    u64 value;
+    u64 size;
+};
+static_assert(sizeof(ELF64Symbol) == 0x18, "ELF64Symbol has incorrect size.");
+
+struct ELF32Symbol {
+    u32 name_index;
+    u32 value;
+    u32 size;
+    union {
+        u8 info;
+
+        BitField<0, 4, ELFSymbolType> type;
+        BitField<4, 4, ELFSymbolBinding> binding;
+    };
+    ELFSymbolVisibility visibility;
+    u16 sh_index;
+};
+static_assert(sizeof(ELF32Symbol) == 0x10, "ELF32Symbol has incorrect size.");
+
+} // Anonymous namespace
+
+namespace Symbols {
+
+template <typename Word, typename ELFSymbol, typename ByteReader>
+static Symbols GetSymbols(ByteReader ReadBytes) {
+    const auto Read8{[&](u64 index) {
+        u8 ret;
+        ReadBytes(&ret, index, sizeof(u8));
+        return ret;
+    }};
+
+    const auto Read32{[&](u64 index) {
+        u32 ret;
+        ReadBytes(&ret, index, sizeof(u32));
+        return ret;
+    }};
+
+    const auto ReadWord{[&](u64 index) {
+        Word ret;
+        ReadBytes(&ret, index, sizeof(Word));
+        return ret;
+    }};
+
+    const u32 mod_offset = Read32(4);
+
+    if (Read32(mod_offset) != Common::MakeMagic('M', 'O', 'D', '0')) {
+        return {};
+    }
+
+    VAddr string_table_offset{};
+    VAddr symbol_table_offset{};
+    u64 symbol_entry_size{};
+
+    const auto dynamic_offset = Read32(mod_offset + 0x4) + mod_offset;
+
+    VAddr dynamic_index = dynamic_offset;
+    while (true) {
+        const Word tag = ReadWord(dynamic_index);
+        const Word value = ReadWord(dynamic_index + sizeof(Word));
+        dynamic_index += 2 * sizeof(Word);
+
+        if (tag == ELF_DYNAMIC_TAG_NULL) {
+            break;
+        }
+
+        if (tag == ELF_DYNAMIC_TAG_STRTAB) {
+            string_table_offset = value;
+        } else if (tag == ELF_DYNAMIC_TAG_SYMTAB) {
+            symbol_table_offset = value;
+        } else if (tag == ELF_DYNAMIC_TAG_SYMENT) {
+            symbol_entry_size = value;
+        }
+    }
+
+    if (string_table_offset == 0 || symbol_table_offset == 0 || symbol_entry_size == 0) {
+        return {};
+    }
+
+    Symbols out;
+
+    VAddr symbol_index = symbol_table_offset;
+    while (symbol_index < string_table_offset) {
+        ELFSymbol symbol{};
+        ReadBytes(&symbol, symbol_index, sizeof(ELFSymbol));
+
+        VAddr string_offset = string_table_offset + symbol.name_index;
+        std::string name;
+        for (u8 c = Read8(string_offset); c != 0; c = Read8(++string_offset)) {
+            name += static_cast<char>(c);
+        }
+
+        symbol_index += symbol_entry_size;
+        out[name] = std::make_pair(symbol.value, symbol.size);
+    }
+
+    return out;
+}
+
+Symbols GetSymbols(VAddr base, Core::Memory::Memory& memory, bool is_64) {
+    const auto ReadBytes{
+        [&](void* ptr, size_t offset, size_t size) { memory.ReadBlock(base + offset, ptr, size); }};
+
+    if (is_64) {
+        return GetSymbols<u64, ELF64Symbol>(ReadBytes);
+    } else {
+        return GetSymbols<u32, ELF32Symbol>(ReadBytes);
+    }
+}
+
+Symbols GetSymbols(std::span<const u8> data, bool is_64) {
+    const auto ReadBytes{[&](void* ptr, size_t offset, size_t size) {
+        std::memcpy(ptr, data.data() + offset, size);
+    }};
+
+    if (is_64) {
+        return GetSymbols<u64, ELF64Symbol>(ReadBytes);
+    } else {
+        return GetSymbols<u32, ELF32Symbol>(ReadBytes);
+    }
+}
+
+std::optional<std::string> GetSymbolName(const Symbols& symbols, VAddr addr) {
+    const auto iter = std::find_if(symbols.cbegin(), symbols.cend(), [addr](const auto& pair) {
+        const auto& [name, sym_info] = pair;
+        const auto& [start_address, size] = sym_info;
+        const auto end_address = start_address + size;
+        return addr >= start_address && addr < end_address;
+    });
+
+    if (iter == symbols.cend()) {
+        return std::nullopt;
+    }
+
+    return iter->first;
+}
+
+} // namespace Symbols
+} // namespace Core
diff --git a/src/core/arm/symbols.h b/src/core/arm/symbols.h
new file mode 100644
index 000000000..99e6a9f8e
--- /dev/null
+++ b/src/core/arm/symbols.h
@@ -0,0 +1,27 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#pragma once
+
+#include <map>
+#include <optional>
+#include <span>
+#include <string>
+#include <utility>
+
+#include "common/common_types.h"
+
+namespace Core::Memory {
+class Memory;
+} // namespace Core::Memory
+
+namespace Core::Symbols {
+
+using Symbols = std::map<std::string, std::pair<VAddr, std::size_t>, std::less<>>;
+
+Symbols GetSymbols(VAddr base, Core::Memory::Memory& memory, bool is_64 = true);
+Symbols GetSymbols(std::span<const u8> data, bool is_64 = true);
+std::optional<std::string> GetSymbolName(const Symbols& symbols, VAddr addr);
+
+} // namespace Core::Symbols
diff --git a/src/core/core.cpp b/src/core/core.cpp
index c60a784c3..b5e2bcae2 100644
--- a/src/core/core.cpp
+++ b/src/core/core.cpp
@@ -38,7 +38,6 @@
 #include "core/hle/service/apm/apm_controller.h"
 #include "core/hle/service/filesystem/filesystem.h"
 #include "core/hle/service/glue/glue_manager.h"
-#include "core/hle/service/hid/hid.h"
 #include "core/hle/service/service.h"
 #include "core/hle/service/sm/sm.h"
 #include "core/hle/service/time/time_manager.h"
diff --git a/src/core/file_sys/directory.h b/src/core/file_sys/directory.h
index 21c7aefc8..9a3b62117 100644
--- a/src/core/file_sys/directory.h
+++ b/src/core/file_sys/directory.h
@@ -5,7 +5,6 @@
 #pragma once
 
 #include <cstddef>
-#include <iterator>
 #include "common/common_funcs.h"
 #include "common/common_types.h"
 
diff --git a/src/core/file_sys/patch_manager.cpp b/src/core/file_sys/patch_manager.cpp
index f19ac4607..73e724f3d 100644
--- a/src/core/file_sys/patch_manager.cpp
+++ b/src/core/file_sys/patch_manager.cpp
@@ -10,7 +10,10 @@
 #include "common/hex_util.h"
 #include "common/logging/log.h"
 #include "common/settings.h"
+#ifndef _WIN32
 #include "common/string_util.h"
+#endif
+
 #include "core/core.h"
 #include "core/file_sys/common_funcs.h"
 #include "core/file_sys/content_archive.h"
@@ -145,29 +148,33 @@ VirtualDir PatchManager::PatchExeFS(VirtualDir exefs) const {
 
     // LayeredExeFS
     const auto load_dir = fs_controller.GetModificationLoadRoot(title_id);
+    const auto sdmc_load_dir = fs_controller.GetSDMCModificationLoadRoot(title_id);
+
+    std::vector<VirtualDir> patch_dirs = {sdmc_load_dir};
     if (load_dir != nullptr && load_dir->GetSize() > 0) {
-        auto patch_dirs = load_dir->GetSubdirectories();
-        std::sort(
-            patch_dirs.begin(), patch_dirs.end(),
-            [](const VirtualDir& l, const VirtualDir& r) { return l->GetName() < r->GetName(); });
-
-        std::vector<VirtualDir> layers;
-        layers.reserve(patch_dirs.size() + 1);
-        for (const auto& subdir : patch_dirs) {
-            if (std::find(disabled.begin(), disabled.end(), subdir->GetName()) != disabled.end())
-                continue;
+        const auto load_patch_dirs = load_dir->GetSubdirectories();
+        patch_dirs.insert(patch_dirs.end(), load_patch_dirs.begin(), load_patch_dirs.end());
+    }
 
-            auto exefs_dir = FindSubdirectoryCaseless(subdir, "exefs");
-            if (exefs_dir != nullptr)
-                layers.push_back(std::move(exefs_dir));
-        }
-        layers.push_back(exefs);
+    std::sort(patch_dirs.begin(), patch_dirs.end(),
+              [](const VirtualDir& l, const VirtualDir& r) { return l->GetName() < r->GetName(); });
 
-        auto layered = LayeredVfsDirectory::MakeLayeredDirectory(std::move(layers));
-        if (layered != nullptr) {
-            LOG_INFO(Loader, "    ExeFS: LayeredExeFS patches applied successfully");
-            exefs = std::move(layered);
-        }
+    std::vector<VirtualDir> layers;
+    layers.reserve(patch_dirs.size() + 1);
+    for (const auto& subdir : patch_dirs) {
+        if (std::find(disabled.begin(), disabled.end(), subdir->GetName()) != disabled.end())
+            continue;
+
+        auto exefs_dir = FindSubdirectoryCaseless(subdir, "exefs");
+        if (exefs_dir != nullptr)
+            layers.push_back(std::move(exefs_dir));
+    }
+    layers.push_back(exefs);
+
+    auto layered = LayeredVfsDirectory::MakeLayeredDirectory(std::move(layers));
+    if (layered != nullptr) {
+        LOG_INFO(Loader, "    ExeFS: LayeredExeFS patches applied successfully");
+        exefs = std::move(layered);
     }
 
     if (Settings::values.dump_exefs) {
@@ -533,11 +540,20 @@ PatchManager::PatchVersionNames PatchManager::GetPatchVersionNames(VirtualFile u
 
     // SDMC mod directory (RomFS LayeredFS)
     const auto sdmc_mod_dir = fs_controller.GetSDMCModificationLoadRoot(title_id);
-    if (sdmc_mod_dir != nullptr && sdmc_mod_dir->GetSize() > 0 &&
-        IsDirValidAndNonEmpty(FindSubdirectoryCaseless(sdmc_mod_dir, "romfs"))) {
-        const auto mod_disabled =
-            std::find(disabled.begin(), disabled.end(), "SDMC") != disabled.end();
-        out.insert_or_assign(mod_disabled ? "[D] SDMC" : "SDMC", "LayeredFS");
+    if (sdmc_mod_dir != nullptr && sdmc_mod_dir->GetSize() > 0) {
+        std::string types;
+        if (IsDirValidAndNonEmpty(FindSubdirectoryCaseless(sdmc_mod_dir, "exefs"))) {
+            AppendCommaIfNotEmpty(types, "LayeredExeFS");
+        }
+        if (IsDirValidAndNonEmpty(FindSubdirectoryCaseless(sdmc_mod_dir, "romfs"))) {
+            AppendCommaIfNotEmpty(types, "LayeredFS");
+        }
+
+        if (!types.empty()) {
+            const auto mod_disabled =
+                std::find(disabled.begin(), disabled.end(), "SDMC") != disabled.end();
+            out.insert_or_assign(mod_disabled ? "[D] SDMC" : "SDMC", types);
+        }
     }
 
     // DLC
diff --git a/src/core/file_sys/program_metadata.h b/src/core/file_sys/program_metadata.h
index 1eee916be..32435e123 100644
--- a/src/core/file_sys/program_metadata.h
+++ b/src/core/file_sys/program_metadata.h
@@ -6,7 +6,9 @@
 
 #include <array>
 #include <vector>
+
 #include "common/bit_field.h"
+#include "common/common_funcs.h"
 #include "common/common_types.h"
 #include "common/swap.h"
 #include "core/file_sys/vfs_types.h"
diff --git a/src/core/file_sys/registered_cache.cpp b/src/core/file_sys/registered_cache.cpp
index 7a646b5f1..4ada4a69b 100644
--- a/src/core/file_sys/registered_cache.cpp
+++ b/src/core/file_sys/registered_cache.cpp
@@ -387,15 +387,17 @@ std::vector<NcaID> RegisteredCache::AccumulateFiles() const {
             continue;
 
         for (const auto& nca_dir : d2_dir->GetSubdirectories()) {
-            if (!FollowsNcaIdFormat(nca_dir->GetName()))
+            if (nca_dir == nullptr || !FollowsNcaIdFormat(nca_dir->GetName())) {
                 continue;
+            }
 
             ids.push_back(Common::HexStringToArray<0x10, true>(nca_dir->GetName().substr(0, 0x20)));
         }
 
         for (const auto& nca_file : d2_dir->GetFiles()) {
-            if (!FollowsNcaIdFormat(nca_file->GetName()))
+            if (nca_file == nullptr || !FollowsNcaIdFormat(nca_file->GetName())) {
                 continue;
+            }
 
             ids.push_back(
                 Common::HexStringToArray<0x10, true>(nca_file->GetName().substr(0, 0x20)));
diff --git a/src/core/frontend/applets/mii_edit.cpp b/src/core/frontend/applets/mii_edit.cpp
new file mode 100644
index 000000000..fadb5fb15
--- /dev/null
+++ b/src/core/frontend/applets/mii_edit.cpp
@@ -0,0 +1,18 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#include "common/logging/log.h"
+#include "core/frontend/applets/mii_edit.h"
+
+namespace Core::Frontend {
+
+MiiEditApplet::~MiiEditApplet() = default;
+
+void DefaultMiiEditApplet::ShowMiiEdit(const std::function<void()>& callback) const {
+    LOG_WARNING(Service_AM, "(STUBBED) called");
+
+    callback();
+}
+
+} // namespace Core::Frontend
diff --git a/src/core/frontend/applets/mii_edit.h b/src/core/frontend/applets/mii_edit.h
new file mode 100644
index 000000000..cca0e931d
--- /dev/null
+++ b/src/core/frontend/applets/mii_edit.h
@@ -0,0 +1,23 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#pragma once
+
+#include <functional>
+
+namespace Core::Frontend {
+
+class MiiEditApplet {
+public:
+    virtual ~MiiEditApplet();
+
+    virtual void ShowMiiEdit(const std::function<void()>& callback) const = 0;
+};
+
+class DefaultMiiEditApplet final : public MiiEditApplet {
+public:
+    void ShowMiiEdit(const std::function<void()>& callback) const override;
+};
+
+} // namespace Core::Frontend
diff --git a/src/core/hid/emulated_console.cpp b/src/core/hid/emulated_console.cpp
index eef0ff493..de565048b 100644
--- a/src/core/hid/emulated_console.cpp
+++ b/src/core/hid/emulated_console.cpp
@@ -132,7 +132,7 @@ void EmulatedConsole::SetMotionParam(Common::ParamPackage param) {
 }
 
 void EmulatedConsole::SetMotion(const Common::Input::CallbackStatus& callback) {
-    std::lock_guard lock{mutex};
+    std::unique_lock lock{mutex};
     auto& raw_status = console.motion_values.raw_status;
     auto& emulated = console.motion_values.emulated;
 
@@ -151,6 +151,7 @@ void EmulatedConsole::SetMotion(const Common::Input::CallbackStatus& callback) {
     emulated.UpdateOrientation(raw_status.delta_timestamp);
 
     if (is_configuring) {
+        lock.unlock();
         TriggerOnChange(ConsoleTriggerType::Motion);
         return;
     }
@@ -166,6 +167,7 @@ void EmulatedConsole::SetMotion(const Common::Input::CallbackStatus& callback) {
     // Find what is this value
     motion.verticalization_error = 0.0f;
 
+    lock.unlock();
     TriggerOnChange(ConsoleTriggerType::Motion);
 }
 
@@ -173,11 +175,12 @@ void EmulatedConsole::SetTouch(const Common::Input::CallbackStatus& callback, st
     if (index >= console.touch_values.size()) {
         return;
     }
-    std::lock_guard lock{mutex};
+    std::unique_lock lock{mutex};
 
     console.touch_values[index] = TransformToTouch(callback);
 
     if (is_configuring) {
+        lock.unlock();
         TriggerOnChange(ConsoleTriggerType::Touch);
         return;
     }
@@ -189,26 +192,32 @@ void EmulatedConsole::SetTouch(const Common::Input::CallbackStatus& callback, st
         .pressed = console.touch_values[index].pressed.value,
     };
 
+    lock.unlock();
     TriggerOnChange(ConsoleTriggerType::Touch);
 }
 
 ConsoleMotionValues EmulatedConsole::GetMotionValues() const {
+    std::scoped_lock lock{mutex};
     return console.motion_values;
 }
 
 TouchValues EmulatedConsole::GetTouchValues() const {
+    std::scoped_lock lock{mutex};
     return console.touch_values;
 }
 
 ConsoleMotion EmulatedConsole::GetMotion() const {
+    std::scoped_lock lock{mutex};
     return console.motion_state;
 }
 
 TouchFingerState EmulatedConsole::GetTouch() const {
+    std::scoped_lock lock{mutex};
     return console.touch_state;
 }
 
 void EmulatedConsole::TriggerOnChange(ConsoleTriggerType type) {
+    std::scoped_lock lock{callback_mutex};
     for (const auto& poller_pair : callback_list) {
         const ConsoleUpdateCallback& poller = poller_pair.second;
         if (poller.on_change) {
@@ -218,13 +227,13 @@ void EmulatedConsole::TriggerOnChange(ConsoleTriggerType type) {
 }
 
 int EmulatedConsole::SetCallback(ConsoleUpdateCallback update_callback) {
-    std::lock_guard lock{mutex};
+    std::scoped_lock lock{callback_mutex};
     callback_list.insert_or_assign(last_callback_key, update_callback);
     return last_callback_key++;
 }
 
 void EmulatedConsole::DeleteCallback(int key) {
-    std::lock_guard lock{mutex};
+    std::scoped_lock lock{callback_mutex};
     const auto& iterator = callback_list.find(key);
     if (iterator == callback_list.end()) {
         LOG_ERROR(Input, "Tried to delete non-existent callback {}", key);
diff --git a/src/core/hid/emulated_console.h b/src/core/hid/emulated_console.h
index 5eb170823..53677bdc5 100644
--- a/src/core/hid/emulated_console.h
+++ b/src/core/hid/emulated_console.h
@@ -183,6 +183,7 @@ private:
     TouchDevices touch_devices;
 
     mutable std::mutex mutex;
+    mutable std::mutex callback_mutex;
     std::unordered_map<int, ConsoleUpdateCallback> callback_list;
     int last_callback_key = 0;
 
diff --git a/src/core/hid/emulated_controller.cpp b/src/core/hid/emulated_controller.cpp
index 7e05666d6..c3f21066c 100644
--- a/src/core/hid/emulated_controller.cpp
+++ b/src/core/hid/emulated_controller.cpp
@@ -353,14 +353,17 @@ void EmulatedController::DisableConfiguration() {
 }
 
 void EmulatedController::EnableSystemButtons() {
+    std::scoped_lock lock{mutex};
     system_buttons_enabled = true;
 }
 
 void EmulatedController::DisableSystemButtons() {
+    std::scoped_lock lock{mutex};
     system_buttons_enabled = false;
 }
 
 void EmulatedController::ResetSystemButtons() {
+    std::scoped_lock lock{mutex};
     controller.home_button_state.home.Assign(false);
     controller.capture_button_state.capture.Assign(false);
 }
@@ -494,139 +497,141 @@ void EmulatedController::SetButton(const Common::Input::CallbackStatus& callback
     if (index >= controller.button_values.size()) {
         return;
     }
-    {
-        std::lock_guard lock{mutex};
-        bool value_changed = false;
-        const auto new_status = TransformToButton(callback);
-        auto& current_status = controller.button_values[index];
+    std::unique_lock lock{mutex};
+    bool value_changed = false;
+    const auto new_status = TransformToButton(callback);
+    auto& current_status = controller.button_values[index];
 
-        // Only read button values that have the same uuid or are pressed once
-        if (current_status.uuid != uuid) {
-            if (!new_status.value) {
-                return;
-            }
+    // Only read button values that have the same uuid or are pressed once
+    if (current_status.uuid != uuid) {
+        if (!new_status.value) {
+            return;
         }
+    }
 
-        current_status.toggle = new_status.toggle;
-        current_status.uuid = uuid;
-
-        // Update button status with current
-        if (!current_status.toggle) {
-            current_status.locked = false;
-            if (current_status.value != new_status.value) {
-                current_status.value = new_status.value;
-                value_changed = true;
-            }
-        } else {
-            // Toggle button and lock status
-            if (new_status.value && !current_status.locked) {
-                current_status.locked = true;
-                current_status.value = !current_status.value;
-                value_changed = true;
-            }
+    current_status.toggle = new_status.toggle;
+    current_status.uuid = uuid;
 
-            // Unlock button ready for next press
-            if (!new_status.value && current_status.locked) {
-                current_status.locked = false;
-            }
+    // Update button status with current
+    if (!current_status.toggle) {
+        current_status.locked = false;
+        if (current_status.value != new_status.value) {
+            current_status.value = new_status.value;
+            value_changed = true;
         }
-
-        if (!value_changed) {
-            return;
+    } else {
+        // Toggle button and lock status
+        if (new_status.value && !current_status.locked) {
+            current_status.locked = true;
+            current_status.value = !current_status.value;
+            value_changed = true;
         }
 
-        if (is_configuring) {
-            controller.npad_button_state.raw = NpadButton::None;
-            controller.debug_pad_button_state.raw = 0;
-            TriggerOnChange(ControllerTriggerType::Button, false);
-            return;
+        // Unlock button ready for next press
+        if (!new_status.value && current_status.locked) {
+            current_status.locked = false;
         }
+    }
 
-        switch (index) {
-        case Settings::NativeButton::A:
-            controller.npad_button_state.a.Assign(current_status.value);
-            controller.debug_pad_button_state.a.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::B:
-            controller.npad_button_state.b.Assign(current_status.value);
-            controller.debug_pad_button_state.b.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::X:
-            controller.npad_button_state.x.Assign(current_status.value);
-            controller.debug_pad_button_state.x.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::Y:
-            controller.npad_button_state.y.Assign(current_status.value);
-            controller.debug_pad_button_state.y.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::LStick:
-            controller.npad_button_state.stick_l.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::RStick:
-            controller.npad_button_state.stick_r.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::L:
-            controller.npad_button_state.l.Assign(current_status.value);
-            controller.debug_pad_button_state.l.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::R:
-            controller.npad_button_state.r.Assign(current_status.value);
-            controller.debug_pad_button_state.r.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::ZL:
-            controller.npad_button_state.zl.Assign(current_status.value);
-            controller.debug_pad_button_state.zl.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::ZR:
-            controller.npad_button_state.zr.Assign(current_status.value);
-            controller.debug_pad_button_state.zr.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::Plus:
-            controller.npad_button_state.plus.Assign(current_status.value);
-            controller.debug_pad_button_state.plus.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::Minus:
-            controller.npad_button_state.minus.Assign(current_status.value);
-            controller.debug_pad_button_state.minus.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::DLeft:
-            controller.npad_button_state.left.Assign(current_status.value);
-            controller.debug_pad_button_state.d_left.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::DUp:
-            controller.npad_button_state.up.Assign(current_status.value);
-            controller.debug_pad_button_state.d_up.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::DRight:
-            controller.npad_button_state.right.Assign(current_status.value);
-            controller.debug_pad_button_state.d_right.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::DDown:
-            controller.npad_button_state.down.Assign(current_status.value);
-            controller.debug_pad_button_state.d_down.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::SL:
-            controller.npad_button_state.left_sl.Assign(current_status.value);
-            controller.npad_button_state.right_sl.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::SR:
-            controller.npad_button_state.left_sr.Assign(current_status.value);
-            controller.npad_button_state.right_sr.Assign(current_status.value);
-            break;
-        case Settings::NativeButton::Home:
-            if (!system_buttons_enabled) {
-                break;
-            }
-            controller.home_button_state.home.Assign(current_status.value);
+    if (!value_changed) {
+        return;
+    }
+
+    if (is_configuring) {
+        controller.npad_button_state.raw = NpadButton::None;
+        controller.debug_pad_button_state.raw = 0;
+        lock.unlock();
+        TriggerOnChange(ControllerTriggerType::Button, false);
+        return;
+    }
+
+    switch (index) {
+    case Settings::NativeButton::A:
+        controller.npad_button_state.a.Assign(current_status.value);
+        controller.debug_pad_button_state.a.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::B:
+        controller.npad_button_state.b.Assign(current_status.value);
+        controller.debug_pad_button_state.b.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::X:
+        controller.npad_button_state.x.Assign(current_status.value);
+        controller.debug_pad_button_state.x.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::Y:
+        controller.npad_button_state.y.Assign(current_status.value);
+        controller.debug_pad_button_state.y.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::LStick:
+        controller.npad_button_state.stick_l.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::RStick:
+        controller.npad_button_state.stick_r.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::L:
+        controller.npad_button_state.l.Assign(current_status.value);
+        controller.debug_pad_button_state.l.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::R:
+        controller.npad_button_state.r.Assign(current_status.value);
+        controller.debug_pad_button_state.r.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::ZL:
+        controller.npad_button_state.zl.Assign(current_status.value);
+        controller.debug_pad_button_state.zl.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::ZR:
+        controller.npad_button_state.zr.Assign(current_status.value);
+        controller.debug_pad_button_state.zr.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::Plus:
+        controller.npad_button_state.plus.Assign(current_status.value);
+        controller.debug_pad_button_state.plus.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::Minus:
+        controller.npad_button_state.minus.Assign(current_status.value);
+        controller.debug_pad_button_state.minus.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::DLeft:
+        controller.npad_button_state.left.Assign(current_status.value);
+        controller.debug_pad_button_state.d_left.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::DUp:
+        controller.npad_button_state.up.Assign(current_status.value);
+        controller.debug_pad_button_state.d_up.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::DRight:
+        controller.npad_button_state.right.Assign(current_status.value);
+        controller.debug_pad_button_state.d_right.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::DDown:
+        controller.npad_button_state.down.Assign(current_status.value);
+        controller.debug_pad_button_state.d_down.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::SL:
+        controller.npad_button_state.left_sl.Assign(current_status.value);
+        controller.npad_button_state.right_sl.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::SR:
+        controller.npad_button_state.left_sr.Assign(current_status.value);
+        controller.npad_button_state.right_sr.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::Home:
+        if (!system_buttons_enabled) {
             break;
-        case Settings::NativeButton::Screenshot:
-            if (!system_buttons_enabled) {
-                break;
-            }
-            controller.capture_button_state.capture.Assign(current_status.value);
+        }
+        controller.home_button_state.home.Assign(current_status.value);
+        break;
+    case Settings::NativeButton::Screenshot:
+        if (!system_buttons_enabled) {
             break;
         }
+        controller.capture_button_state.capture.Assign(current_status.value);
+        break;
     }
+
+    lock.unlock();
+
     if (!is_connected) {
         if (npad_id_type == NpadIdType::Player1 && npad_type != NpadStyleIndex::Handheld) {
             Connect();
@@ -643,7 +648,7 @@ void EmulatedController::SetStick(const Common::Input::CallbackStatus& callback,
     if (index >= controller.stick_values.size()) {
         return;
     }
-    std::lock_guard lock{mutex};
+    std::unique_lock lock{mutex};
     const auto stick_value = TransformToStick(callback);
 
     // Only read stick values that have the same uuid or are over the threshold to avoid flapping
@@ -659,6 +664,7 @@ void EmulatedController::SetStick(const Common::Input::CallbackStatus& callback,
     if (is_configuring) {
         controller.analog_stick_state.left = {};
         controller.analog_stick_state.right = {};
+        lock.unlock();
         TriggerOnChange(ControllerTriggerType::Stick, false);
         return;
     }
@@ -685,6 +691,7 @@ void EmulatedController::SetStick(const Common::Input::CallbackStatus& callback,
         break;
     }
 
+    lock.unlock();
     TriggerOnChange(ControllerTriggerType::Stick, true);
 }
 
@@ -693,7 +700,7 @@ void EmulatedController::SetTrigger(const Common::Input::CallbackStatus& callbac
     if (index >= controller.trigger_values.size()) {
         return;
     }
-    std::lock_guard lock{mutex};
+    std::unique_lock lock{mutex};
     const auto trigger_value = TransformToTrigger(callback);
 
     // Only read trigger values that have the same uuid or are pressed once
@@ -709,6 +716,7 @@ void EmulatedController::SetTrigger(const Common::Input::CallbackStatus& callbac
     if (is_configuring) {
         controller.gc_trigger_state.left = 0;
         controller.gc_trigger_state.right = 0;
+        lock.unlock();
         TriggerOnChange(ControllerTriggerType::Trigger, false);
         return;
     }
@@ -727,6 +735,7 @@ void EmulatedController::SetTrigger(const Common::Input::CallbackStatus& callbac
         break;
     }
 
+    lock.unlock();
     TriggerOnChange(ControllerTriggerType::Trigger, true);
 }
 
@@ -735,7 +744,7 @@ void EmulatedController::SetMotion(const Common::Input::CallbackStatus& callback
     if (index >= controller.motion_values.size()) {
         return;
     }
-    std::lock_guard lock{mutex};
+    std::unique_lock lock{mutex};
     auto& raw_status = controller.motion_values[index].raw_status;
     auto& emulated = controller.motion_values[index].emulated;
 
@@ -756,6 +765,7 @@ void EmulatedController::SetMotion(const Common::Input::CallbackStatus& callback
     force_update_motion = raw_status.force_update;
 
     if (is_configuring) {
+        lock.unlock();
         TriggerOnChange(ControllerTriggerType::Motion, false);
         return;
     }
@@ -767,6 +777,7 @@ void EmulatedController::SetMotion(const Common::Input::CallbackStatus& callback
     motion.orientation = emulated.GetOrientation();
     motion.is_at_rest = !emulated.IsMoving(motion_sensitivity);
 
+    lock.unlock();
     TriggerOnChange(ControllerTriggerType::Motion, true);
 }
 
@@ -775,10 +786,11 @@ void EmulatedController::SetBattery(const Common::Input::CallbackStatus& callbac
     if (index >= controller.battery_values.size()) {
         return;
     }
-    std::lock_guard lock{mutex};
+    std::unique_lock lock{mutex};
     controller.battery_values[index] = TransformToBattery(callback);
 
     if (is_configuring) {
+        lock.unlock();
         TriggerOnChange(ControllerTriggerType::Battery, false);
         return;
     }
@@ -835,6 +847,8 @@ void EmulatedController::SetBattery(const Common::Input::CallbackStatus& callbac
         };
         break;
     }
+
+    lock.unlock();
     TriggerOnChange(ControllerTriggerType::Battery, true);
 }
 
@@ -932,6 +946,7 @@ void EmulatedController::SetSupportedNpadStyleTag(NpadStyleTag supported_styles)
 }
 
 bool EmulatedController::IsControllerFullkey(bool use_temporary_value) const {
+    std::scoped_lock lock{mutex};
     const auto type = is_configuring && use_temporary_value ? tmp_npad_type : npad_type;
     switch (type) {
     case NpadStyleIndex::ProController:
@@ -947,6 +962,7 @@ bool EmulatedController::IsControllerFullkey(bool use_temporary_value) const {
 }
 
 bool EmulatedController::IsControllerSupported(bool use_temporary_value) const {
+    std::scoped_lock lock{mutex};
     const auto type = is_configuring && use_temporary_value ? tmp_npad_type : npad_type;
     switch (type) {
     case NpadStyleIndex::ProController:
@@ -982,40 +998,44 @@ void EmulatedController::Connect(bool use_temporary_value) {
         LOG_ERROR(Service_HID, "Controller type {} is not supported", type);
         return;
     }
-    {
-        std::lock_guard lock{mutex};
-        if (is_configuring) {
-            tmp_is_connected = true;
-            TriggerOnChange(ControllerTriggerType::Connected, false);
-            return;
-        }
 
-        if (is_connected) {
-            return;
-        }
-        is_connected = true;
+    std::unique_lock lock{mutex};
+    if (is_configuring) {
+        tmp_is_connected = true;
+        lock.unlock();
+        TriggerOnChange(ControllerTriggerType::Connected, false);
+        return;
+    }
+
+    if (is_connected) {
+        return;
     }
+    is_connected = true;
+
+    lock.unlock();
     TriggerOnChange(ControllerTriggerType::Connected, true);
 }
 
 void EmulatedController::Disconnect() {
-    {
-        std::lock_guard lock{mutex};
-        if (is_configuring) {
-            tmp_is_connected = false;
-            TriggerOnChange(ControllerTriggerType::Disconnected, false);
-            return;
-        }
+    std::unique_lock lock{mutex};
+    if (is_configuring) {
+        tmp_is_connected = false;
+        lock.unlock();
+        TriggerOnChange(ControllerTriggerType::Disconnected, false);
+        return;
+    }
 
-        if (!is_connected) {
-            return;
-        }
-        is_connected = false;
+    if (!is_connected) {
+        return;
     }
+    is_connected = false;
+
+    lock.unlock();
     TriggerOnChange(ControllerTriggerType::Disconnected, true);
 }
 
 bool EmulatedController::IsConnected(bool get_temporary_value) const {
+    std::scoped_lock lock{mutex};
     if (get_temporary_value && is_configuring) {
         return tmp_is_connected;
     }
@@ -1029,10 +1049,12 @@ bool EmulatedController::IsVibrationEnabled() const {
 }
 
 NpadIdType EmulatedController::GetNpadIdType() const {
+    std::scoped_lock lock{mutex};
     return npad_id_type;
 }
 
 NpadStyleIndex EmulatedController::GetNpadStyleIndex(bool get_temporary_value) const {
+    std::scoped_lock lock{mutex};
     if (get_temporary_value && is_configuring) {
         return tmp_npad_type;
     }
@@ -1040,27 +1062,28 @@ NpadStyleIndex EmulatedController::GetNpadStyleIndex(bool get_temporary_value) c
 }
 
 void EmulatedController::SetNpadStyleIndex(NpadStyleIndex npad_type_) {
-    {
-        std::lock_guard lock{mutex};
+    std::unique_lock lock{mutex};
 
-        if (is_configuring) {
-            if (tmp_npad_type == npad_type_) {
-                return;
-            }
-            tmp_npad_type = npad_type_;
-            TriggerOnChange(ControllerTriggerType::Type, false);
+    if (is_configuring) {
+        if (tmp_npad_type == npad_type_) {
             return;
         }
+        tmp_npad_type = npad_type_;
+        lock.unlock();
+        TriggerOnChange(ControllerTriggerType::Type, false);
+        return;
+    }
 
-        if (npad_type == npad_type_) {
-            return;
-        }
-        if (is_connected) {
-            LOG_WARNING(Service_HID, "Controller {} type changed while it's connected",
-                        NpadIdTypeToIndex(npad_id_type));
-        }
-        npad_type = npad_type_;
+    if (npad_type == npad_type_) {
+        return;
+    }
+    if (is_connected) {
+        LOG_WARNING(Service_HID, "Controller {} type changed while it's connected",
+                    NpadIdTypeToIndex(npad_id_type));
     }
+    npad_type = npad_type_;
+
+    lock.unlock();
     TriggerOnChange(ControllerTriggerType::Type, true);
 }
 
@@ -1088,30 +1111,37 @@ LedPattern EmulatedController::GetLedPattern() const {
 }
 
 ButtonValues EmulatedController::GetButtonsValues() const {
+    std::scoped_lock lock{mutex};
     return controller.button_values;
 }
 
 SticksValues EmulatedController::GetSticksValues() const {
+    std::scoped_lock lock{mutex};
     return controller.stick_values;
 }
 
 TriggerValues EmulatedController::GetTriggersValues() const {
+    std::scoped_lock lock{mutex};
     return controller.trigger_values;
 }
 
 ControllerMotionValues EmulatedController::GetMotionValues() const {
+    std::scoped_lock lock{mutex};
     return controller.motion_values;
 }
 
 ColorValues EmulatedController::GetColorsValues() const {
+    std::scoped_lock lock{mutex};
     return controller.color_values;
 }
 
 BatteryValues EmulatedController::GetBatteryValues() const {
+    std::scoped_lock lock{mutex};
     return controller.battery_values;
 }
 
 HomeButtonState EmulatedController::GetHomeButtons() const {
+    std::scoped_lock lock{mutex};
     if (is_configuring) {
         return {};
     }
@@ -1119,6 +1149,7 @@ HomeButtonState EmulatedController::GetHomeButtons() const {
 }
 
 CaptureButtonState EmulatedController::GetCaptureButtons() const {
+    std::scoped_lock lock{mutex};
     if (is_configuring) {
         return {};
     }
@@ -1126,6 +1157,7 @@ CaptureButtonState EmulatedController::GetCaptureButtons() const {
 }
 
 NpadButtonState EmulatedController::GetNpadButtons() const {
+    std::scoped_lock lock{mutex};
     if (is_configuring) {
         return {};
     }
@@ -1133,6 +1165,7 @@ NpadButtonState EmulatedController::GetNpadButtons() const {
 }
 
 DebugPadButton EmulatedController::GetDebugPadButtons() const {
+    std::scoped_lock lock{mutex};
     if (is_configuring) {
         return {};
     }
@@ -1140,20 +1173,27 @@ DebugPadButton EmulatedController::GetDebugPadButtons() const {
 }
 
 AnalogSticks EmulatedController::GetSticks() const {
+    std::unique_lock lock{mutex};
+
     if (is_configuring) {
         return {};
     }
+
     // Some drivers like stick from buttons need constant refreshing
     for (auto& device : stick_devices) {
         if (!device) {
             continue;
         }
+        lock.unlock();
         device->SoftUpdate();
+        lock.lock();
     }
+
     return controller.analog_stick_state;
 }
 
 NpadGcTriggerState EmulatedController::GetTriggers() const {
+    std::scoped_lock lock{mutex};
     if (is_configuring) {
         return {};
     }
@@ -1161,26 +1201,35 @@ NpadGcTriggerState EmulatedController::GetTriggers() const {
 }
 
 MotionState EmulatedController::GetMotions() const {
+    std::unique_lock lock{mutex};
+
+    // Some drivers like mouse motion need constant refreshing
     if (force_update_motion) {
         for (auto& device : motion_devices) {
             if (!device) {
                 continue;
             }
+            lock.unlock();
             device->ForceUpdate();
+            lock.lock();
         }
     }
+
     return controller.motion_state;
 }
 
 ControllerColors EmulatedController::GetColors() const {
+    std::scoped_lock lock{mutex};
     return controller.colors_state;
 }
 
 BatteryLevelState EmulatedController::GetBattery() const {
+    std::scoped_lock lock{mutex};
     return controller.battery_state;
 }
 
 void EmulatedController::TriggerOnChange(ControllerTriggerType type, bool is_npad_service_update) {
+    std::scoped_lock lock{callback_mutex};
     for (const auto& poller_pair : callback_list) {
         const ControllerUpdateCallback& poller = poller_pair.second;
         if (!is_npad_service_update && poller.is_npad_service) {
@@ -1193,13 +1242,13 @@ void EmulatedController::TriggerOnChange(ControllerTriggerType type, bool is_npa
 }
 
 int EmulatedController::SetCallback(ControllerUpdateCallback update_callback) {
-    std::lock_guard lock{mutex};
+    std::scoped_lock lock{callback_mutex};
     callback_list.insert_or_assign(last_callback_key, std::move(update_callback));
     return last_callback_key++;
 }
 
 void EmulatedController::DeleteCallback(int key) {
-    std::lock_guard lock{mutex};
+    std::scoped_lock lock{callback_mutex};
     const auto& iterator = callback_list.find(key);
     if (iterator == callback_list.end()) {
         LOG_ERROR(Input, "Tried to delete non-existent callback {}", key);
diff --git a/src/core/hid/emulated_controller.h b/src/core/hid/emulated_controller.h
index aa52f9572..1e224685d 100644
--- a/src/core/hid/emulated_controller.h
+++ b/src/core/hid/emulated_controller.h
@@ -400,7 +400,7 @@ private:
      */
     void TriggerOnChange(ControllerTriggerType type, bool is_service_update);
 
-    NpadIdType npad_id_type;
+    const NpadIdType npad_id_type;
     NpadStyleIndex npad_type{NpadStyleIndex::None};
     NpadStyleTag supported_style_tag{NpadStyleSet::All};
     bool is_connected{false};
@@ -434,6 +434,7 @@ private:
     StickDevices tas_stick_devices;
 
     mutable std::mutex mutex;
+    mutable std::mutex callback_mutex;
     std::unordered_map<int, ControllerUpdateCallback> callback_list;
     int last_callback_key = 0;
 
diff --git a/src/core/hid/emulated_devices.cpp b/src/core/hid/emulated_devices.cpp
index 708480f2d..cc0dcd931 100644
--- a/src/core/hid/emulated_devices.cpp
+++ b/src/core/hid/emulated_devices.cpp
@@ -169,7 +169,7 @@ void EmulatedDevices::SetKeyboardButton(const Common::Input::CallbackStatus& cal
     if (index >= device_status.keyboard_values.size()) {
         return;
     }
-    std::lock_guard lock{mutex};
+    std::unique_lock lock{mutex};
     bool value_changed = false;
     const auto new_status = TransformToButton(callback);
     auto& current_status = device_status.keyboard_values[index];
@@ -201,6 +201,7 @@ void EmulatedDevices::SetKeyboardButton(const Common::Input::CallbackStatus& cal
     }
 
     if (is_configuring) {
+        lock.unlock();
         TriggerOnChange(DeviceTriggerType::Keyboard);
         return;
     }
@@ -208,6 +209,7 @@ void EmulatedDevices::SetKeyboardButton(const Common::Input::CallbackStatus& cal
     // Index should be converted from NativeKeyboard to KeyboardKeyIndex
     UpdateKey(index, current_status.value);
 
+    lock.unlock();
     TriggerOnChange(DeviceTriggerType::Keyboard);
 }
 
@@ -227,7 +229,7 @@ void EmulatedDevices::SetKeyboardModifier(const Common::Input::CallbackStatus& c
     if (index >= device_status.keyboard_moddifier_values.size()) {
         return;
     }
-    std::lock_guard lock{mutex};
+    std::unique_lock lock{mutex};
     bool value_changed = false;
     const auto new_status = TransformToButton(callback);
     auto& current_status = device_status.keyboard_moddifier_values[index];
@@ -259,6 +261,7 @@ void EmulatedDevices::SetKeyboardModifier(const Common::Input::CallbackStatus& c
     }
 
     if (is_configuring) {
+        lock.unlock();
         TriggerOnChange(DeviceTriggerType::KeyboardModdifier);
         return;
     }
@@ -289,6 +292,7 @@ void EmulatedDevices::SetKeyboardModifier(const Common::Input::CallbackStatus& c
         break;
     }
 
+    lock.unlock();
     TriggerOnChange(DeviceTriggerType::KeyboardModdifier);
 }
 
@@ -297,7 +301,7 @@ void EmulatedDevices::SetMouseButton(const Common::Input::CallbackStatus& callba
     if (index >= device_status.mouse_button_values.size()) {
         return;
     }
-    std::lock_guard lock{mutex};
+    std::unique_lock lock{mutex};
     bool value_changed = false;
     const auto new_status = TransformToButton(callback);
     auto& current_status = device_status.mouse_button_values[index];
@@ -329,6 +333,7 @@ void EmulatedDevices::SetMouseButton(const Common::Input::CallbackStatus& callba
     }
 
     if (is_configuring) {
+        lock.unlock();
         TriggerOnChange(DeviceTriggerType::Mouse);
         return;
     }
@@ -351,6 +356,7 @@ void EmulatedDevices::SetMouseButton(const Common::Input::CallbackStatus& callba
         break;
     }
 
+    lock.unlock();
     TriggerOnChange(DeviceTriggerType::Mouse);
 }
 
@@ -359,13 +365,14 @@ void EmulatedDevices::SetMouseAnalog(const Common::Input::CallbackStatus& callba
     if (index >= device_status.mouse_analog_values.size()) {
         return;
     }
-    std::lock_guard lock{mutex};
+    std::unique_lock lock{mutex};
     const auto analog_value = TransformToAnalog(callback);
 
     device_status.mouse_analog_values[index] = analog_value;
 
     if (is_configuring) {
         device_status.mouse_position_state = {};
+        lock.unlock();
         TriggerOnChange(DeviceTriggerType::Mouse);
         return;
     }
@@ -379,17 +386,19 @@ void EmulatedDevices::SetMouseAnalog(const Common::Input::CallbackStatus& callba
         break;
     }
 
+    lock.unlock();
     TriggerOnChange(DeviceTriggerType::Mouse);
 }
 
 void EmulatedDevices::SetMouseStick(const Common::Input::CallbackStatus& callback) {
-    std::lock_guard lock{mutex};
+    std::unique_lock lock{mutex};
     const auto touch_value = TransformToTouch(callback);
 
     device_status.mouse_stick_value = touch_value;
 
     if (is_configuring) {
         device_status.mouse_position_state = {};
+        lock.unlock();
         TriggerOnChange(DeviceTriggerType::Mouse);
         return;
     }
@@ -397,42 +406,52 @@ void EmulatedDevices::SetMouseStick(const Common::Input::CallbackStatus& callbac
     device_status.mouse_position_state.x = touch_value.x.value;
     device_status.mouse_position_state.y = touch_value.y.value;
 
+    lock.unlock();
     TriggerOnChange(DeviceTriggerType::Mouse);
 }
 
 KeyboardValues EmulatedDevices::GetKeyboardValues() const {
+    std::scoped_lock lock{mutex};
     return device_status.keyboard_values;
 }
 
 KeyboardModifierValues EmulatedDevices::GetKeyboardModdifierValues() const {
+    std::scoped_lock lock{mutex};
     return device_status.keyboard_moddifier_values;
 }
 
 MouseButtonValues EmulatedDevices::GetMouseButtonsValues() const {
+    std::scoped_lock lock{mutex};
     return device_status.mouse_button_values;
 }
 
 KeyboardKey EmulatedDevices::GetKeyboard() const {
+    std::scoped_lock lock{mutex};
     return device_status.keyboard_state;
 }
 
 KeyboardModifier EmulatedDevices::GetKeyboardModifier() const {
+    std::scoped_lock lock{mutex};
     return device_status.keyboard_moddifier_state;
 }
 
 MouseButton EmulatedDevices::GetMouseButtons() const {
+    std::scoped_lock lock{mutex};
     return device_status.mouse_button_state;
 }
 
 MousePosition EmulatedDevices::GetMousePosition() const {
+    std::scoped_lock lock{mutex};
     return device_status.mouse_position_state;
 }
 
 AnalogStickState EmulatedDevices::GetMouseWheel() const {
+    std::scoped_lock lock{mutex};
     return device_status.mouse_wheel_state;
 }
 
 void EmulatedDevices::TriggerOnChange(DeviceTriggerType type) {
+    std::scoped_lock lock{callback_mutex};
     for (const auto& poller_pair : callback_list) {
         const InterfaceUpdateCallback& poller = poller_pair.second;
         if (poller.on_change) {
@@ -442,13 +461,13 @@ void EmulatedDevices::TriggerOnChange(DeviceTriggerType type) {
 }
 
 int EmulatedDevices::SetCallback(InterfaceUpdateCallback update_callback) {
-    std::lock_guard lock{mutex};
+    std::scoped_lock lock{callback_mutex};
     callback_list.insert_or_assign(last_callback_key, std::move(update_callback));
     return last_callback_key++;
 }
 
 void EmulatedDevices::DeleteCallback(int key) {
-    std::lock_guard lock{mutex};
+    std::scoped_lock lock{callback_mutex};
     const auto& iterator = callback_list.find(key);
     if (iterator == callback_list.end()) {
         LOG_ERROR(Input, "Tried to delete non-existent callback {}", key);
diff --git a/src/core/hid/emulated_devices.h b/src/core/hid/emulated_devices.h
index 790d3b411..73e9f0293 100644
--- a/src/core/hid/emulated_devices.h
+++ b/src/core/hid/emulated_devices.h
@@ -200,6 +200,7 @@ private:
     MouseStickDevice mouse_stick_device;
 
     mutable std::mutex mutex;
+    mutable std::mutex callback_mutex;
     std::unordered_map<int, InterfaceUpdateCallback> callback_list;
     int last_callback_key = 0;
 
diff --git a/src/core/hle/ipc_helpers.h b/src/core/hle/ipc_helpers.h
index 026257115..3c4e45fcd 100644
--- a/src/core/hle/ipc_helpers.h
+++ b/src/core/hle/ipc_helpers.h
@@ -385,7 +385,7 @@ public:
     T PopRaw();
 
     template <class T>
-    std::shared_ptr<T> PopIpcInterface() {
+    std::weak_ptr<T> PopIpcInterface() {
         ASSERT(context->Session()->IsDomain());
         ASSERT(context->GetDomainMessageHeader().input_object_count > 0);
         return context->GetDomainHandler<T>(Pop<u32>() - 1);
diff --git a/src/core/hle/kernel/board/nintendo/nx/k_system_control.cpp b/src/core/hle/kernel/board/nintendo/nx/k_system_control.cpp
index 8027bec00..7765e7848 100644
--- a/src/core/hle/kernel/board/nintendo/nx/k_system_control.cpp
+++ b/src/core/hle/kernel/board/nintendo/nx/k_system_control.cpp
@@ -148,9 +148,9 @@ u64 GenerateUniformRange(u64 min, u64 max, F f) {
 } // Anonymous namespace
 
 u64 KSystemControl::GenerateRandomU64() {
-    static std::random_device device;
-    static std::mt19937 gen(device());
-    static std::uniform_int_distribution<u64> distribution(1, std::numeric_limits<u64>::max());
+    std::random_device device;
+    std::mt19937 gen(device());
+    std::uniform_int_distribution<u64> distribution(1, std::numeric_limits<u64>::max());
     return distribution(gen);
 }
 
diff --git a/src/core/hle/kernel/hle_ipc.cpp b/src/core/hle/kernel/hle_ipc.cpp
index e19544c54..5828ac923 100644
--- a/src/core/hle/kernel/hle_ipc.cpp
+++ b/src/core/hle/kernel/hle_ipc.cpp
@@ -17,7 +17,6 @@
 #include "core/hle/kernel/k_auto_object.h"
 #include "core/hle/kernel/k_handle_table.h"
 #include "core/hle/kernel/k_process.h"
-#include "core/hle/kernel/k_readable_event.h"
 #include "core/hle/kernel/k_server_session.h"
 #include "core/hle/kernel/k_thread.h"
 #include "core/hle/kernel/kernel.h"
@@ -25,8 +24,15 @@
 
 namespace Kernel {
 
-SessionRequestHandler::SessionRequestHandler(KernelCore& kernel_, const char* service_name_)
-    : kernel{kernel_}, service_thread{kernel.CreateServiceThread(service_name_)} {}
+SessionRequestHandler::SessionRequestHandler(KernelCore& kernel_, const char* service_name_,
+                                             ServiceThreadType thread_type)
+    : kernel{kernel_} {
+    if (thread_type == ServiceThreadType::CreateNew) {
+        service_thread = kernel.CreateServiceThread(service_name_);
+    } else {
+        service_thread = kernel.GetDefaultServiceThread();
+    }
+}
 
 SessionRequestHandler::~SessionRequestHandler() {
     kernel.ReleaseServiceThread(service_thread);
@@ -45,7 +51,7 @@ bool SessionRequestManager::HasSessionRequestHandler(const HLERequestContext& co
             LOG_CRITICAL(IPC, "object_id {} is too big!", object_id);
             return false;
         }
-        return DomainHandler(object_id - 1) != nullptr;
+        return !DomainHandler(object_id - 1).expired();
     } else {
         return session_handler != nullptr;
     }
@@ -55,7 +61,7 @@ void SessionRequestHandler::ClientConnected(KServerSession* session) {
     session->ClientConnected(shared_from_this());
 
     // Ensure our server session is tracked globally.
-    kernel.RegisterServerSession(session);
+    kernel.RegisterServerObject(session);
 }
 
 void SessionRequestHandler::ClientDisconnected(KServerSession* session) {
diff --git a/src/core/hle/kernel/hle_ipc.h b/src/core/hle/kernel/hle_ipc.h
index 754b41ff6..640146137 100644
--- a/src/core/hle/kernel/hle_ipc.h
+++ b/src/core/hle/kernel/hle_ipc.h
@@ -33,6 +33,11 @@ namespace Service {
 class ServiceFrameworkBase;
 }
 
+enum class ServiceThreadType {
+    Default,
+    CreateNew,
+};
+
 namespace Kernel {
 
 class Domain;
@@ -57,7 +62,8 @@ enum class ThreadWakeupReason;
  */
 class SessionRequestHandler : public std::enable_shared_from_this<SessionRequestHandler> {
 public:
-    SessionRequestHandler(KernelCore& kernel, const char* service_name_);
+    SessionRequestHandler(KernelCore& kernel_, const char* service_name_,
+                          ServiceThreadType thread_type);
     virtual ~SessionRequestHandler();
 
     /**
@@ -94,6 +100,7 @@ protected:
     std::weak_ptr<ServiceThread> service_thread;
 };
 
+using SessionRequestHandlerWeakPtr = std::weak_ptr<SessionRequestHandler>;
 using SessionRequestHandlerPtr = std::shared_ptr<SessionRequestHandler>;
 
 /**
@@ -139,7 +146,7 @@ public:
         }
     }
 
-    SessionRequestHandlerPtr DomainHandler(std::size_t index) const {
+    SessionRequestHandlerWeakPtr DomainHandler(std::size_t index) const {
         ASSERT_MSG(index < DomainHandlerCount(), "Unexpected handler index {}", index);
         return domain_handlers.at(index);
     }
@@ -328,10 +335,10 @@ public:
 
     template <typename T>
     std::shared_ptr<T> GetDomainHandler(std::size_t index) const {
-        return std::static_pointer_cast<T>(manager->DomainHandler(index));
+        return std::static_pointer_cast<T>(manager.lock()->DomainHandler(index).lock());
     }
 
-    void SetSessionRequestManager(std::shared_ptr<SessionRequestManager> manager_) {
+    void SetSessionRequestManager(std::weak_ptr<SessionRequestManager> manager_) {
         manager = std::move(manager_);
     }
 
@@ -374,7 +381,7 @@ private:
     u32 handles_offset{};
     u32 domain_offset{};
 
-    std::shared_ptr<SessionRequestManager> manager;
+    std::weak_ptr<SessionRequestManager> manager;
 
     KernelCore& kernel;
     Core::Memory::Memory& memory;
diff --git a/src/core/hle/kernel/init/init_slab_setup.cpp b/src/core/hle/kernel/init/init_slab_setup.cpp
index 36fc0944a..b0f773ee0 100644
--- a/src/core/hle/kernel/init/init_slab_setup.cpp
+++ b/src/core/hle/kernel/init/init_slab_setup.cpp
@@ -7,19 +7,23 @@
 #include "common/common_funcs.h"
 #include "common/common_types.h"
 #include "core/core.h"
+#include "core/device_memory.h"
 #include "core/hardware_properties.h"
 #include "core/hle/kernel/init/init_slab_setup.h"
 #include "core/hle/kernel/k_code_memory.h"
 #include "core/hle/kernel/k_event.h"
 #include "core/hle/kernel/k_memory_layout.h"
 #include "core/hle/kernel/k_memory_manager.h"
+#include "core/hle/kernel/k_page_buffer.h"
 #include "core/hle/kernel/k_port.h"
 #include "core/hle/kernel/k_process.h"
 #include "core/hle/kernel/k_resource_limit.h"
 #include "core/hle/kernel/k_session.h"
 #include "core/hle/kernel/k_shared_memory.h"
+#include "core/hle/kernel/k_shared_memory_info.h"
 #include "core/hle/kernel/k_system_control.h"
 #include "core/hle/kernel/k_thread.h"
+#include "core/hle/kernel/k_thread_local_page.h"
 #include "core/hle/kernel/k_transfer_memory.h"
 
 namespace Kernel::Init {
@@ -32,9 +36,13 @@ namespace Kernel::Init {
     HANDLER(KEvent, (SLAB_COUNT(KEvent)), ##__VA_ARGS__)                                           \
     HANDLER(KPort, (SLAB_COUNT(KPort)), ##__VA_ARGS__)                                             \
     HANDLER(KSharedMemory, (SLAB_COUNT(KSharedMemory)), ##__VA_ARGS__)                             \
+    HANDLER(KSharedMemoryInfo, (SLAB_COUNT(KSharedMemory) * 8), ##__VA_ARGS__)                     \
     HANDLER(KTransferMemory, (SLAB_COUNT(KTransferMemory)), ##__VA_ARGS__)                         \
     HANDLER(KCodeMemory, (SLAB_COUNT(KCodeMemory)), ##__VA_ARGS__)                                 \
     HANDLER(KSession, (SLAB_COUNT(KSession)), ##__VA_ARGS__)                                       \
+    HANDLER(KThreadLocalPage,                                                                      \
+            (SLAB_COUNT(KProcess) + (SLAB_COUNT(KProcess) + SLAB_COUNT(KThread)) / 8),             \
+            ##__VA_ARGS__)                                                                         \
     HANDLER(KResourceLimit, (SLAB_COUNT(KResourceLimit)), ##__VA_ARGS__)
 
 namespace {
@@ -50,38 +58,46 @@ enum KSlabType : u32 {
 // Constexpr counts.
 constexpr size_t SlabCountKProcess = 80;
 constexpr size_t SlabCountKThread = 800;
-constexpr size_t SlabCountKEvent = 700;
+constexpr size_t SlabCountKEvent = 900;
 constexpr size_t SlabCountKInterruptEvent = 100;
-constexpr size_t SlabCountKPort = 256 + 0x20; // Extra 0x20 ports over Nintendo for homebrew.
+constexpr size_t SlabCountKPort = 384;
 constexpr size_t SlabCountKSharedMemory = 80;
 constexpr size_t SlabCountKTransferMemory = 200;
 constexpr size_t SlabCountKCodeMemory = 10;
 constexpr size_t SlabCountKDeviceAddressSpace = 300;
-constexpr size_t SlabCountKSession = 933;
+constexpr size_t SlabCountKSession = 1133;
 constexpr size_t SlabCountKLightSession = 100;
 constexpr size_t SlabCountKObjectName = 7;
 constexpr size_t SlabCountKResourceLimit = 5;
 constexpr size_t SlabCountKDebug = Core::Hardware::NUM_CPU_CORES;
-constexpr size_t SlabCountKAlpha = 1;
-constexpr size_t SlabCountKBeta = 6;
+constexpr size_t SlabCountKIoPool = 1;
+constexpr size_t SlabCountKIoRegion = 6;
 
 constexpr size_t SlabCountExtraKThread = 160;
 
+/// Helper function to translate from the slab virtual address to the reserved location in physical
+/// memory.
+static PAddr TranslateSlabAddrToPhysical(KMemoryLayout& memory_layout, VAddr slab_addr) {
+    slab_addr -= memory_layout.GetSlabRegionAddress();
+    return slab_addr + Core::DramMemoryMap::SlabHeapBase;
+}
+
 template <typename T>
 VAddr InitializeSlabHeap(Core::System& system, KMemoryLayout& memory_layout, VAddr address,
                          size_t num_objects) {
-    // TODO(bunnei): This is just a place holder. We should initialize the appropriate KSlabHeap for
-    // kernel object type T with the backing kernel memory pointer once we emulate kernel memory.
 
     const size_t size = Common::AlignUp(sizeof(T) * num_objects, alignof(void*));
     VAddr start = Common::AlignUp(address, alignof(T));
 
-    // This is intentionally empty. Once KSlabHeap is fully implemented, we can replace this with
-    // the pointer to emulated memory to pass along. Until then, KSlabHeap will just allocate/free
-    // host memory.
-    void* backing_kernel_memory{};
+    // This should use the virtual memory address passed in, but currently, we do not setup the
+    // kernel virtual memory layout. Instead, we simply map these at a region of physical memory
+    // that we reserve for the slab heaps.
+    // TODO(bunnei): Fix this once we support the kernel virtual memory layout.
 
     if (size > 0) {
+        void* backing_kernel_memory{
+            system.DeviceMemory().GetPointer(TranslateSlabAddrToPhysical(memory_layout, start))};
+
         const KMemoryRegion* region = memory_layout.FindVirtual(start + size - 1);
         ASSERT(region != nullptr);
         ASSERT(region->IsDerivedFrom(KMemoryRegionType_KernelSlab));
@@ -91,6 +107,12 @@ VAddr InitializeSlabHeap(Core::System& system, KMemoryLayout& memory_layout, VAd
     return start + size;
 }
 
+size_t CalculateSlabHeapGapSize() {
+    constexpr size_t KernelSlabHeapGapSize = 2_MiB - 296_KiB;
+    static_assert(KernelSlabHeapGapSize <= KernelSlabHeapGapsSizeMax);
+    return KernelSlabHeapGapSize;
+}
+
 } // namespace
 
 KSlabResourceCounts KSlabResourceCounts::CreateDefault() {
@@ -109,8 +131,8 @@ KSlabResourceCounts KSlabResourceCounts::CreateDefault() {
         .num_KObjectName = SlabCountKObjectName,
         .num_KResourceLimit = SlabCountKResourceLimit,
         .num_KDebug = SlabCountKDebug,
-        .num_KAlpha = SlabCountKAlpha,
-        .num_KBeta = SlabCountKBeta,
+        .num_KIoPool = SlabCountKIoPool,
+        .num_KIoRegion = SlabCountKIoRegion,
     };
 }
 
@@ -136,11 +158,34 @@ size_t CalculateTotalSlabHeapSize(const KernelCore& kernel) {
 #undef ADD_SLAB_SIZE
 
     // Add the reserved size.
-    size += KernelSlabHeapGapsSize;
+    size += CalculateSlabHeapGapSize();
 
     return size;
 }
 
+void InitializeKPageBufferSlabHeap(Core::System& system) {
+    auto& kernel = system.Kernel();
+
+    const auto& counts = kernel.SlabResourceCounts();
+    const size_t num_pages =
+        counts.num_KProcess + counts.num_KThread + (counts.num_KProcess + counts.num_KThread) / 8;
+    const size_t slab_size = num_pages * PageSize;
+
+    // Reserve memory from the system resource limit.
+    ASSERT(kernel.GetSystemResourceLimit()->Reserve(LimitableResource::PhysicalMemory, slab_size));
+
+    // Allocate memory for the slab.
+    constexpr auto AllocateOption = KMemoryManager::EncodeOption(
+        KMemoryManager::Pool::System, KMemoryManager::Direction::FromFront);
+    const PAddr slab_address =
+        kernel.MemoryManager().AllocateAndOpenContinuous(num_pages, 1, AllocateOption);
+    ASSERT(slab_address != 0);
+
+    // Initialize the slabheap.
+    KPageBuffer::InitializeSlabHeap(kernel, system.DeviceMemory().GetPointer(slab_address),
+                                    slab_size);
+}
+
 void InitializeSlabHeaps(Core::System& system, KMemoryLayout& memory_layout) {
     auto& kernel = system.Kernel();
 
@@ -160,13 +205,13 @@ void InitializeSlabHeaps(Core::System& system, KMemoryLayout& memory_layout) {
     }
 
     // Create an array to represent the gaps between the slabs.
-    const size_t total_gap_size = KernelSlabHeapGapsSize;
+    const size_t total_gap_size = CalculateSlabHeapGapSize();
     std::array<size_t, slab_types.size()> slab_gaps;
-    for (size_t i = 0; i < slab_gaps.size(); i++) {
+    for (auto& slab_gap : slab_gaps) {
         // Note: This is an off-by-one error from Nintendo's intention, because GenerateRandomRange
         // is inclusive. However, Nintendo also has the off-by-one error, and it's "harmless", so we
         // will include it ourselves.
-        slab_gaps[i] = KSystemControl::GenerateRandomRange(0, total_gap_size);
+        slab_gap = KSystemControl::GenerateRandomRange(0, total_gap_size);
     }
 
     // Sort the array, so that we can treat differences between values as offsets to the starts of
@@ -177,13 +222,21 @@ void InitializeSlabHeaps(Core::System& system, KMemoryLayout& memory_layout) {
         }
     }
 
-    for (size_t i = 0; i < slab_types.size(); i++) {
+    // Track the gaps, so that we can free them to the unused slab tree.
+    VAddr gap_start = address;
+    size_t gap_size = 0;
+
+    for (size_t i = 0; i < slab_gaps.size(); i++) {
         // Add the random gap to the address.
-        address += (i == 0) ? slab_gaps[0] : slab_gaps[i] - slab_gaps[i - 1];
+        const auto cur_gap = (i == 0) ? slab_gaps[0] : slab_gaps[i] - slab_gaps[i - 1];
+        address += cur_gap;
+        gap_size += cur_gap;
 
 #define INITIALIZE_SLAB_HEAP(NAME, COUNT, ...)                                                     \
     case KSlabType_##NAME:                                                                         \
-        address = InitializeSlabHeap<NAME>(system, memory_layout, address, COUNT);                 \
+        if (COUNT > 0) {                                                                           \
+            address = InitializeSlabHeap<NAME>(system, memory_layout, address, COUNT);             \
+        }                                                                                          \
         break;
 
         // Initialize the slabheap.
@@ -192,7 +245,13 @@ void InitializeSlabHeaps(Core::System& system, KMemoryLayout& memory_layout) {
             FOREACH_SLAB_TYPE(INITIALIZE_SLAB_HEAP)
             // If we somehow get an invalid type, abort.
         default:
-            UNREACHABLE();
+            UNREACHABLE_MSG("Unknown slab type: {}", slab_types[i]);
+        }
+
+        // If we've hit the end of a gap, free it.
+        if (gap_start + gap_size != address) {
+            gap_start = address;
+            gap_size = 0;
         }
     }
 }
diff --git a/src/core/hle/kernel/init/init_slab_setup.h b/src/core/hle/kernel/init/init_slab_setup.h
index a8f7e0918..f54b67d02 100644
--- a/src/core/hle/kernel/init/init_slab_setup.h
+++ b/src/core/hle/kernel/init/init_slab_setup.h
@@ -32,12 +32,13 @@ struct KSlabResourceCounts {
     size_t num_KObjectName;
     size_t num_KResourceLimit;
     size_t num_KDebug;
-    size_t num_KAlpha;
-    size_t num_KBeta;
+    size_t num_KIoPool;
+    size_t num_KIoRegion;
 };
 
 void InitializeSlabResourceCounts(KernelCore& kernel);
 size_t CalculateTotalSlabHeapSize(const KernelCore& kernel);
+void InitializeKPageBufferSlabHeap(Core::System& system);
 void InitializeSlabHeaps(Core::System& system, KMemoryLayout& memory_layout);
 
 } // namespace Kernel::Init
diff --git a/src/core/hle/kernel/k_address_arbiter.cpp b/src/core/hle/kernel/k_address_arbiter.cpp
index 1d1f5e5f8..8cdd0490f 100644
--- a/src/core/hle/kernel/k_address_arbiter.cpp
+++ b/src/core/hle/kernel/k_address_arbiter.cpp
@@ -115,7 +115,7 @@ ResultCode KAddressArbiter::Signal(VAddr addr, s32 count) {
     {
         KScopedSchedulerLock sl(kernel);
 
-        auto it = thread_tree.nfind_light({addr, -1});
+        auto it = thread_tree.nfind_key({addr, -1});
         while ((it != thread_tree.end()) && (count <= 0 || num_waiters < count) &&
                (it->GetAddressArbiterKey() == addr)) {
             // End the thread's wait.
@@ -148,7 +148,7 @@ ResultCode KAddressArbiter::SignalAndIncrementIfEqual(VAddr addr, s32 value, s32
             return ResultInvalidState;
         }
 
-        auto it = thread_tree.nfind_light({addr, -1});
+        auto it = thread_tree.nfind_key({addr, -1});
         while ((it != thread_tree.end()) && (count <= 0 || num_waiters < count) &&
                (it->GetAddressArbiterKey() == addr)) {
             // End the thread's wait.
@@ -171,7 +171,7 @@ ResultCode KAddressArbiter::SignalAndModifyByWaitingCountIfEqual(VAddr addr, s32
     {
         [[maybe_unused]] const KScopedSchedulerLock sl(kernel);
 
-        auto it = thread_tree.nfind_light({addr, -1});
+        auto it = thread_tree.nfind_key({addr, -1});
         // Determine the updated value.
         s32 new_value{};
         if (count <= 0) {
diff --git a/src/core/hle/kernel/k_auto_object.h b/src/core/hle/kernel/k_auto_object.h
index 05779f2d5..423e8d8f5 100644
--- a/src/core/hle/kernel/k_auto_object.h
+++ b/src/core/hle/kernel/k_auto_object.h
@@ -89,9 +89,7 @@ public:
     explicit KAutoObject(KernelCore& kernel_) : kernel(kernel_) {
         RegisterWithKernel();
     }
-    virtual ~KAutoObject() {
-        UnregisterWithKernel();
-    }
+    virtual ~KAutoObject() = default;
 
     static KAutoObject* Create(KAutoObject* ptr);
 
@@ -163,11 +161,12 @@ public:
         do {
             ASSERT(cur_ref_count > 0);
         } while (!m_ref_count.compare_exchange_weak(cur_ref_count, cur_ref_count - 1,
-                                                    std::memory_order_relaxed));
+                                                    std::memory_order_acq_rel));
 
         // If ref count hits zero, destroy the object.
         if (cur_ref_count - 1 == 0) {
             this->Destroy();
+            this->UnregisterWithKernel();
         }
     }
 
diff --git a/src/core/hle/kernel/k_class_token.h b/src/core/hle/kernel/k_class_token.h
index 980010150..93fc8786d 100644
--- a/src/core/hle/kernel/k_class_token.h
+++ b/src/core/hle/kernel/k_class_token.h
@@ -4,8 +4,6 @@
 
 #pragma once
 
-#include <atomic>
-
 #include "common/bit_util.h"
 #include "common/common_types.h"
 
diff --git a/src/core/hle/kernel/k_code_memory.cpp b/src/core/hle/kernel/k_code_memory.cpp
index 0b225e8e0..09eaf004c 100644
--- a/src/core/hle/kernel/k_code_memory.cpp
+++ b/src/core/hle/kernel/k_code_memory.cpp
@@ -5,7 +5,6 @@
 #include "common/alignment.h"
 #include "common/common_types.h"
 #include "core/device_memory.h"
-#include "core/hle/kernel/k_auto_object.h"
 #include "core/hle/kernel/k_code_memory.h"
 #include "core/hle/kernel/k_light_lock.h"
 #include "core/hle/kernel/k_memory_block.h"
@@ -29,15 +28,21 @@ ResultCode KCodeMemory::Initialize(Core::DeviceMemory& device_memory, VAddr addr
     auto& page_table = m_owner->PageTable();
 
     // Construct the page group.
-    m_page_group = KPageLinkedList(addr, Common::DivideUp(size, PageSize));
+    m_page_group =
+        KPageLinkedList(page_table.GetPhysicalAddr(addr), Common::DivideUp(size, PageSize));
 
     // Lock the memory.
     R_TRY(page_table.LockForCodeMemory(addr, size))
 
     // Clear the memory.
-    for (const auto& block : m_page_group.Nodes()) {
-        std::memset(device_memory.GetPointer(block.GetAddress()), 0xFF, block.GetSize());
-    }
+    //
+    // FIXME: this ends up clobbering address ranges outside the scope of the mapping within
+    // guest memory, and is not specifically required if the guest program is correctly
+    // written, so disable until this is further investigated.
+    //
+    // for (const auto& block : m_page_group.Nodes()) {
+    //     std::memset(device_memory.GetPointer(block.GetAddress()), 0xFF, block.GetSize());
+    // }
 
     // Set remaining tracking members.
     m_address = addr;
diff --git a/src/core/hle/kernel/k_condition_variable.cpp b/src/core/hle/kernel/k_condition_variable.cpp
index aadcc297a..aa29922d0 100644
--- a/src/core/hle/kernel/k_condition_variable.cpp
+++ b/src/core/hle/kernel/k_condition_variable.cpp
@@ -9,7 +9,6 @@
 #include "core/hle/kernel/k_process.h"
 #include "core/hle/kernel/k_scheduler.h"
 #include "core/hle/kernel/k_scoped_scheduler_lock_and_sleep.h"
-#include "core/hle/kernel/k_synchronization_object.h"
 #include "core/hle/kernel/k_thread.h"
 #include "core/hle/kernel/k_thread_queue.h"
 #include "core/hle/kernel/kernel.h"
@@ -244,7 +243,7 @@ void KConditionVariable::Signal(u64 cv_key, s32 count) {
     {
         KScopedSchedulerLock sl(kernel);
 
-        auto it = thread_tree.nfind_light({cv_key, -1});
+        auto it = thread_tree.nfind_key({cv_key, -1});
         while ((it != thread_tree.end()) && (count <= 0 || num_waiters < count) &&
                (it->GetConditionVariableKey() == cv_key)) {
             KThread* target_thread = std::addressof(*it);
diff --git a/src/core/hle/kernel/k_handle_table.cpp b/src/core/hle/kernel/k_handle_table.cpp
index cf95f0852..db7512ee7 100644
--- a/src/core/hle/kernel/k_handle_table.cpp
+++ b/src/core/hle/kernel/k_handle_table.cpp
@@ -63,7 +63,7 @@ bool KHandleTable::Remove(Handle handle) {
     return true;
 }
 
-ResultCode KHandleTable::Add(Handle* out_handle, KAutoObject* obj, u16 type) {
+ResultCode KHandleTable::Add(Handle* out_handle, KAutoObject* obj) {
     KScopedDisableDispatch dd(kernel);
     KScopedSpinLock lk(m_lock);
 
@@ -75,7 +75,7 @@ ResultCode KHandleTable::Add(Handle* out_handle, KAutoObject* obj, u16 type) {
         const auto linear_id = this->AllocateLinearId();
         const auto index = this->AllocateEntry();
 
-        m_entry_infos[index].info = {.linear_id = linear_id, .type = type};
+        m_entry_infos[index].linear_id = linear_id;
         m_objects[index] = obj;
 
         obj->Open();
@@ -116,7 +116,7 @@ void KHandleTable::Unreserve(Handle handle) {
     }
 }
 
-void KHandleTable::Register(Handle handle, KAutoObject* obj, u16 type) {
+void KHandleTable::Register(Handle handle, KAutoObject* obj) {
     KScopedDisableDispatch dd(kernel);
     KScopedSpinLock lk(m_lock);
 
@@ -132,7 +132,7 @@ void KHandleTable::Register(Handle handle, KAutoObject* obj, u16 type) {
         // Set the entry.
         ASSERT(m_objects[index] == nullptr);
 
-        m_entry_infos[index].info = {.linear_id = static_cast<u16>(linear_id), .type = type};
+        m_entry_infos[index].linear_id = static_cast<u16>(linear_id);
         m_objects[index] = obj;
 
         obj->Open();
diff --git a/src/core/hle/kernel/k_handle_table.h b/src/core/hle/kernel/k_handle_table.h
index 87004a0f9..dd27689b6 100644
--- a/src/core/hle/kernel/k_handle_table.h
+++ b/src/core/hle/kernel/k_handle_table.h
@@ -42,7 +42,7 @@ public:
         m_free_head_index = -1;
 
         // Free all entries.
-        for (s32 i = 0; i < static_cast<s32>(m_table_size); ++i) {
+        for (s16 i = 0; i < static_cast<s16>(m_table_size); ++i) {
             m_objects[i] = nullptr;
             m_entry_infos[i].next_free_index = i - 1;
             m_free_head_index = i;
@@ -104,17 +104,8 @@ public:
     ResultCode Reserve(Handle* out_handle);
     void Unreserve(Handle handle);
 
-    template <typename T>
-    ResultCode Add(Handle* out_handle, T* obj) {
-        static_assert(std::is_base_of_v<KAutoObject, T>);
-        return this->Add(out_handle, obj, obj->GetTypeObj().GetClassToken());
-    }
-
-    template <typename T>
-    void Register(Handle handle, T* obj) {
-        static_assert(std::is_base_of_v<KAutoObject, T>);
-        return this->Register(handle, obj, obj->GetTypeObj().GetClassToken());
-    }
+    ResultCode Add(Handle* out_handle, KAutoObject* obj);
+    void Register(Handle handle, KAutoObject* obj);
 
     template <typename T>
     bool GetMultipleObjects(T** out, const Handle* handles, size_t num_handles) const {
@@ -160,9 +151,6 @@ public:
     }
 
 private:
-    ResultCode Add(Handle* out_handle, KAutoObject* obj, u16 type);
-    void Register(Handle handle, KAutoObject* obj, u16 type);
-
     s32 AllocateEntry() {
         ASSERT(m_count < m_table_size);
 
@@ -179,7 +167,7 @@ private:
         ASSERT(m_count > 0);
 
         m_objects[index] = nullptr;
-        m_entry_infos[index].next_free_index = m_free_head_index;
+        m_entry_infos[index].next_free_index = static_cast<s16>(m_free_head_index);
 
         m_free_head_index = index;
 
@@ -278,19 +266,13 @@ private:
     }
 
     union EntryInfo {
-        struct {
-            u16 linear_id;
-            u16 type;
-        } info;
-        s32 next_free_index;
+        u16 linear_id;
+        s16 next_free_index;
 
         constexpr u16 GetLinearId() const {
-            return info.linear_id;
-        }
-        constexpr u16 GetType() const {
-            return info.type;
+            return linear_id;
         }
-        constexpr s32 GetNextFreeIndex() const {
+        constexpr s16 GetNextFreeIndex() const {
             return next_free_index;
         }
     };
diff --git a/src/core/hle/kernel/k_memory_layout.h b/src/core/hle/kernel/k_memory_layout.h
index bcddb0d62..0858827b6 100644
--- a/src/core/hle/kernel/k_memory_layout.h
+++ b/src/core/hle/kernel/k_memory_layout.h
@@ -57,11 +57,11 @@ constexpr std::size_t KernelPageTableHeapSize = GetMaximumOverheadSize(MainMemor
 constexpr std::size_t KernelInitialPageHeapSize = 128_KiB;
 
 constexpr std::size_t KernelSlabHeapDataSize = 5_MiB;
-constexpr std::size_t KernelSlabHeapGapsSize = 2_MiB - 64_KiB;
-constexpr std::size_t KernelSlabHeapSize = KernelSlabHeapDataSize + KernelSlabHeapGapsSize;
+constexpr std::size_t KernelSlabHeapGapsSizeMax = 2_MiB - 64_KiB;
+constexpr std::size_t KernelSlabHeapSize = KernelSlabHeapDataSize + KernelSlabHeapGapsSizeMax;
 
 // NOTE: This is calculated from KThread slab counts, assuming KThread size <= 0x860.
-constexpr std::size_t KernelSlabHeapAdditionalSize = 416_KiB;
+constexpr std::size_t KernelSlabHeapAdditionalSize = 0x68000;
 
 constexpr std::size_t KernelResourceSize =
     KernelPageTableHeapSize + KernelInitialPageHeapSize + KernelSlabHeapSize;
diff --git a/src/core/hle/kernel/k_memory_manager.cpp b/src/core/hle/kernel/k_memory_manager.cpp
index a2f18f643..17a1b76c7 100644
--- a/src/core/hle/kernel/k_memory_manager.cpp
+++ b/src/core/hle/kernel/k_memory_manager.cpp
@@ -15,7 +15,6 @@
 #include "core/hle/kernel/k_page_linked_list.h"
 #include "core/hle/kernel/kernel.h"
 #include "core/hle/kernel/svc_results.h"
-#include "core/memory.h"
 
 namespace Kernel {
 
diff --git a/src/core/hle/kernel/k_page_buffer.cpp b/src/core/hle/kernel/k_page_buffer.cpp
new file mode 100644
index 000000000..f7df4a9a8
--- /dev/null
+++ b/src/core/hle/kernel/k_page_buffer.cpp
@@ -0,0 +1,19 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#include "common/alignment.h"
+#include "common/assert.h"
+#include "core/core.h"
+#include "core/device_memory.h"
+#include "core/hle/kernel/k_page_buffer.h"
+#include "core/hle/kernel/memory_types.h"
+
+namespace Kernel {
+
+KPageBuffer* KPageBuffer::FromPhysicalAddress(Core::System& system, PAddr phys_addr) {
+    ASSERT(Common::IsAligned(phys_addr, PageSize));
+    return reinterpret_cast<KPageBuffer*>(system.DeviceMemory().GetPointer(phys_addr));
+}
+
+} // namespace Kernel
diff --git a/src/core/hle/kernel/k_page_buffer.h b/src/core/hle/kernel/k_page_buffer.h
new file mode 100644
index 000000000..1d11a4e27
--- /dev/null
+++ b/src/core/hle/kernel/k_page_buffer.h
@@ -0,0 +1,28 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#pragma once
+
+#include <array>
+
+#include "common/common_types.h"
+#include "core/hle/kernel/memory_types.h"
+#include "core/hle/kernel/slab_helpers.h"
+
+namespace Kernel {
+
+class KPageBuffer final : public KSlabAllocated<KPageBuffer> {
+public:
+    KPageBuffer() = default;
+
+    static KPageBuffer* FromPhysicalAddress(Core::System& system, PAddr phys_addr);
+
+private:
+    [[maybe_unused]] alignas(PageSize) std::array<u8, PageSize> m_buffer{};
+};
+
+static_assert(sizeof(KPageBuffer) == PageSize);
+static_assert(alignof(KPageBuffer) == PageSize);
+
+} // namespace Kernel
diff --git a/src/core/hle/kernel/k_page_linked_list.h b/src/core/hle/kernel/k_page_linked_list.h
index 0e2ae582a..869228322 100644
--- a/src/core/hle/kernel/k_page_linked_list.h
+++ b/src/core/hle/kernel/k_page_linked_list.h
@@ -89,6 +89,10 @@ public:
         return ResultSuccess;
     }
 
+    bool Empty() const {
+        return nodes.empty();
+    }
+
 private:
     std::list<Node> nodes;
 };
diff --git a/src/core/hle/kernel/k_page_table.cpp b/src/core/hle/kernel/k_page_table.cpp
index 0602de1f7..47ea3c89c 100644
--- a/src/core/hle/kernel/k_page_table.cpp
+++ b/src/core/hle/kernel/k_page_table.cpp
@@ -346,7 +346,8 @@ ResultCode KPageTable::MapCodeMemory(VAddr dst_address, VAddr src_address, std::
     return ResultSuccess;
 }
 
-ResultCode KPageTable::UnmapCodeMemory(VAddr dst_address, VAddr src_address, std::size_t size) {
+ResultCode KPageTable::UnmapCodeMemory(VAddr dst_address, VAddr src_address, std::size_t size,
+                                       ICacheInvalidationStrategy icache_invalidation_strategy) {
     // Validate the mapping request.
     R_UNLESS(this->CanContain(dst_address, size, KMemoryState::AliasCode),
              ResultInvalidMemoryRegion);
@@ -396,7 +397,11 @@ ResultCode KPageTable::UnmapCodeMemory(VAddr dst_address, VAddr src_address, std
     bool reprotected_pages = false;
     SCOPE_EXIT({
         if (reprotected_pages && any_code_pages) {
-            system.InvalidateCpuInstructionCacheRange(dst_address, size);
+            if (icache_invalidation_strategy == ICacheInvalidationStrategy::InvalidateRange) {
+                system.InvalidateCpuInstructionCacheRange(dst_address, size);
+            } else {
+                system.InvalidateCpuInstructionCaches();
+            }
         }
     });
 
@@ -424,6 +429,120 @@ ResultCode KPageTable::UnmapCodeMemory(VAddr dst_address, VAddr src_address, std
     return ResultSuccess;
 }
 
+VAddr KPageTable::FindFreeArea(VAddr region_start, std::size_t region_num_pages,
+                               std::size_t num_pages, std::size_t alignment, std::size_t offset,
+                               std::size_t guard_pages) {
+    VAddr address = 0;
+
+    if (num_pages <= region_num_pages) {
+        if (this->IsAslrEnabled()) {
+            // Try to directly find a free area up to 8 times.
+            for (std::size_t i = 0; i < 8; i++) {
+                const std::size_t random_offset =
+                    KSystemControl::GenerateRandomRange(
+                        0, (region_num_pages - num_pages - guard_pages) * PageSize / alignment) *
+                    alignment;
+                const VAddr candidate =
+                    Common::AlignDown((region_start + random_offset), alignment) + offset;
+
+                KMemoryInfo info = this->QueryInfoImpl(candidate);
+
+                if (info.state != KMemoryState::Free) {
+                    continue;
+                }
+                if (region_start > candidate) {
+                    continue;
+                }
+                if (info.GetAddress() + guard_pages * PageSize > candidate) {
+                    continue;
+                }
+
+                const VAddr candidate_end = candidate + (num_pages + guard_pages) * PageSize - 1;
+                if (candidate_end > info.GetLastAddress()) {
+                    continue;
+                }
+                if (candidate_end > region_start + region_num_pages * PageSize - 1) {
+                    continue;
+                }
+
+                address = candidate;
+                break;
+            }
+            // Fall back to finding the first free area with a random offset.
+            if (address == 0) {
+                // NOTE: Nintendo does not account for guard pages here.
+                // This may theoretically cause an offset to be chosen that cannot be mapped. We
+                // will account for guard pages.
+                const std::size_t offset_pages = KSystemControl::GenerateRandomRange(
+                    0, region_num_pages - num_pages - guard_pages);
+                address = block_manager->FindFreeArea(region_start + offset_pages * PageSize,
+                                                      region_num_pages - offset_pages, num_pages,
+                                                      alignment, offset, guard_pages);
+            }
+        }
+
+        // Find the first free area.
+        if (address == 0) {
+            address = block_manager->FindFreeArea(region_start, region_num_pages, num_pages,
+                                                  alignment, offset, guard_pages);
+        }
+    }
+
+    return address;
+}
+
+ResultCode KPageTable::MakePageGroup(KPageLinkedList& pg, VAddr addr, size_t num_pages) {
+    ASSERT(this->IsLockedByCurrentThread());
+
+    const size_t size = num_pages * PageSize;
+
+    // We're making a new group, not adding to an existing one.
+    R_UNLESS(pg.Empty(), ResultInvalidCurrentMemory);
+
+    // Begin traversal.
+    Common::PageTable::TraversalContext context;
+    Common::PageTable::TraversalEntry next_entry;
+    R_UNLESS(page_table_impl.BeginTraversal(next_entry, context, addr), ResultInvalidCurrentMemory);
+
+    // Prepare tracking variables.
+    PAddr cur_addr = next_entry.phys_addr;
+    size_t cur_size = next_entry.block_size - (cur_addr & (next_entry.block_size - 1));
+    size_t tot_size = cur_size;
+
+    // Iterate, adding to group as we go.
+    const auto& memory_layout = system.Kernel().MemoryLayout();
+    while (tot_size < size) {
+        R_UNLESS(page_table_impl.ContinueTraversal(next_entry, context),
+                 ResultInvalidCurrentMemory);
+
+        if (next_entry.phys_addr != (cur_addr + cur_size)) {
+            const size_t cur_pages = cur_size / PageSize;
+
+            R_UNLESS(IsHeapPhysicalAddress(memory_layout, cur_addr), ResultInvalidCurrentMemory);
+            R_TRY(pg.AddBlock(cur_addr, cur_pages));
+
+            cur_addr = next_entry.phys_addr;
+            cur_size = next_entry.block_size;
+        } else {
+            cur_size += next_entry.block_size;
+        }
+
+        tot_size += next_entry.block_size;
+    }
+
+    // Ensure we add the right amount for the last block.
+    if (tot_size > size) {
+        cur_size -= (tot_size - size);
+    }
+
+    // Add the last block.
+    const size_t cur_pages = cur_size / PageSize;
+    R_UNLESS(IsHeapPhysicalAddress(memory_layout, cur_addr), ResultInvalidCurrentMemory);
+    R_TRY(pg.AddBlock(cur_addr, cur_pages));
+
+    return ResultSuccess;
+}
+
 ResultCode KPageTable::UnmapProcessMemory(VAddr dst_addr, std::size_t size,
                                           KPageTable& src_page_table, VAddr src_addr) {
     KScopedLightLock lk(general_lock);
@@ -449,6 +568,8 @@ ResultCode KPageTable::UnmapProcessMemory(VAddr dst_addr, std::size_t size,
     block_manager->Update(dst_addr, num_pages, KMemoryState::Free, KMemoryPermission::None,
                           KMemoryAttribute::None);
 
+    system.InvalidateCpuInstructionCaches();
+
     return ResultSuccess;
 }
 
@@ -1055,6 +1176,46 @@ ResultCode KPageTable::MapPages(VAddr address, KPageLinkedList& page_linked_list
     return ResultSuccess;
 }
 
+ResultCode KPageTable::MapPages(VAddr* out_addr, std::size_t num_pages, std::size_t alignment,
+                                PAddr phys_addr, bool is_pa_valid, VAddr region_start,
+                                std::size_t region_num_pages, KMemoryState state,
+                                KMemoryPermission perm) {
+    ASSERT(Common::IsAligned(alignment, PageSize) && alignment >= PageSize);
+
+    // Ensure this is a valid map request.
+    R_UNLESS(this->CanContain(region_start, region_num_pages * PageSize, state),
+             ResultInvalidCurrentMemory);
+    R_UNLESS(num_pages < region_num_pages, ResultOutOfMemory);
+
+    // Lock the table.
+    KScopedLightLock lk(general_lock);
+
+    // Find a random address to map at.
+    VAddr addr = this->FindFreeArea(region_start, region_num_pages, num_pages, alignment, 0,
+                                    this->GetNumGuardPages());
+    R_UNLESS(addr != 0, ResultOutOfMemory);
+    ASSERT(Common::IsAligned(addr, alignment));
+    ASSERT(this->CanContain(addr, num_pages * PageSize, state));
+    ASSERT(this->CheckMemoryState(addr, num_pages * PageSize, KMemoryState::All, KMemoryState::Free,
+                                  KMemoryPermission::None, KMemoryPermission::None,
+                                  KMemoryAttribute::None, KMemoryAttribute::None)
+               .IsSuccess());
+
+    // Perform mapping operation.
+    if (is_pa_valid) {
+        R_TRY(this->Operate(addr, num_pages, perm, OperationType::Map, phys_addr));
+    } else {
+        UNIMPLEMENTED();
+    }
+
+    // Update the blocks.
+    block_manager->Update(addr, num_pages, state, perm);
+
+    // We successfully mapped the pages.
+    *out_addr = addr;
+    return ResultSuccess;
+}
+
 ResultCode KPageTable::UnmapPages(VAddr addr, const KPageLinkedList& page_linked_list) {
     ASSERT(this->IsLockedByCurrentThread());
 
@@ -1097,6 +1258,55 @@ ResultCode KPageTable::UnmapPages(VAddr addr, KPageLinkedList& page_linked_list,
     return ResultSuccess;
 }
 
+ResultCode KPageTable::UnmapPages(VAddr address, std::size_t num_pages, KMemoryState state) {
+    // Check that the unmap is in range.
+    const std::size_t size = num_pages * PageSize;
+    R_UNLESS(this->Contains(address, size), ResultInvalidCurrentMemory);
+
+    // Lock the table.
+    KScopedLightLock lk(general_lock);
+
+    // Check the memory state.
+    std::size_t num_allocator_blocks{};
+    R_TRY(this->CheckMemoryState(std::addressof(num_allocator_blocks), address, size,
+                                 KMemoryState::All, state, KMemoryPermission::None,
+                                 KMemoryPermission::None, KMemoryAttribute::All,
+                                 KMemoryAttribute::None));
+
+    // Perform the unmap.
+    R_TRY(Operate(address, num_pages, KMemoryPermission::None, OperationType::Unmap));
+
+    // Update the blocks.
+    block_manager->Update(address, num_pages, KMemoryState::Free, KMemoryPermission::None);
+
+    return ResultSuccess;
+}
+
+ResultCode KPageTable::MakeAndOpenPageGroup(KPageLinkedList* out, VAddr address, size_t num_pages,
+                                            KMemoryState state_mask, KMemoryState state,
+                                            KMemoryPermission perm_mask, KMemoryPermission perm,
+                                            KMemoryAttribute attr_mask, KMemoryAttribute attr) {
+    // Ensure that the page group isn't null.
+    ASSERT(out != nullptr);
+
+    // Make sure that the region we're mapping is valid for the table.
+    const size_t size = num_pages * PageSize;
+    R_UNLESS(this->Contains(address, size), ResultInvalidCurrentMemory);
+
+    // Lock the table.
+    KScopedLightLock lk(general_lock);
+
+    // Check if state allows us to create the group.
+    R_TRY(this->CheckMemoryState(address, size, state_mask | KMemoryState::FlagReferenceCounted,
+                                 state | KMemoryState::FlagReferenceCounted, perm_mask, perm,
+                                 attr_mask, attr));
+
+    // Create a new page group for the region.
+    R_TRY(this->MakePageGroup(*out, address, num_pages));
+
+    return ResultSuccess;
+}
+
 ResultCode KPageTable::SetProcessMemoryPermission(VAddr addr, std::size_t size,
                                                   Svc::MemoryPermission svc_perm) {
     const size_t num_pages = size / PageSize;
@@ -1479,57 +1689,21 @@ ResultCode KPageTable::UnlockForDeviceAddressSpace(VAddr addr, std::size_t size)
 }
 
 ResultCode KPageTable::LockForCodeMemory(VAddr addr, std::size_t size) {
-    KScopedLightLock lk(general_lock);
-
-    KMemoryPermission new_perm = KMemoryPermission::NotMapped | KMemoryPermission::KernelReadWrite;
-
-    KMemoryPermission old_perm{};
-
-    if (const ResultCode result{CheckMemoryState(
-            nullptr, &old_perm, nullptr, nullptr, addr, size, KMemoryState::FlagCanCodeMemory,
-            KMemoryState::FlagCanCodeMemory, KMemoryPermission::All,
-            KMemoryPermission::UserReadWrite, KMemoryAttribute::All, KMemoryAttribute::None)};
-        result.IsError()) {
-        return result;
-    }
-
-    new_perm = (new_perm != KMemoryPermission::None) ? new_perm : old_perm;
-
-    block_manager->UpdateLock(
-        addr, size / PageSize,
-        [](KMemoryBlockManager::iterator block, KMemoryPermission permission) {
-            block->ShareToDevice(permission);
-        },
-        new_perm);
-
-    return ResultSuccess;
+    return this->LockMemoryAndOpen(
+        nullptr, nullptr, addr, size, KMemoryState::FlagCanCodeMemory,
+        KMemoryState::FlagCanCodeMemory, KMemoryPermission::All, KMemoryPermission::UserReadWrite,
+        KMemoryAttribute::All, KMemoryAttribute::None,
+        static_cast<KMemoryPermission>(KMemoryPermission::NotMapped |
+                                       KMemoryPermission::KernelReadWrite),
+        KMemoryAttribute::Locked);
 }
 
 ResultCode KPageTable::UnlockForCodeMemory(VAddr addr, std::size_t size) {
-    KScopedLightLock lk(general_lock);
-
-    KMemoryPermission new_perm = KMemoryPermission::UserReadWrite;
-
-    KMemoryPermission old_perm{};
-
-    if (const ResultCode result{CheckMemoryState(
-            nullptr, &old_perm, nullptr, nullptr, addr, size, KMemoryState::FlagCanCodeMemory,
-            KMemoryState::FlagCanCodeMemory, KMemoryPermission::None, KMemoryPermission::None,
-            KMemoryAttribute::All, KMemoryAttribute::Locked)};
-        result.IsError()) {
-        return result;
-    }
-
-    new_perm = (new_perm != KMemoryPermission::None) ? new_perm : old_perm;
-
-    block_manager->UpdateLock(
-        addr, size / PageSize,
-        [](KMemoryBlockManager::iterator block, KMemoryPermission permission) {
-            block->UnshareToDevice(permission);
-        },
-        new_perm);
-
-    return ResultSuccess;
+    return this->UnlockMemory(addr, size, KMemoryState::FlagCanCodeMemory,
+                              KMemoryState::FlagCanCodeMemory, KMemoryPermission::None,
+                              KMemoryPermission::None, KMemoryAttribute::All,
+                              KMemoryAttribute::Locked, KMemoryPermission::UserReadWrite,
+                              KMemoryAttribute::Locked, nullptr);
 }
 
 ResultCode KPageTable::InitializeMemoryLayout(VAddr start, VAddr end) {
@@ -1865,4 +2039,109 @@ ResultCode KPageTable::CheckMemoryState(KMemoryState* out_state, KMemoryPermissi
     return ResultSuccess;
 }
 
+ResultCode KPageTable::LockMemoryAndOpen(KPageLinkedList* out_pg, PAddr* out_paddr, VAddr addr,
+                                         size_t size, KMemoryState state_mask, KMemoryState state,
+                                         KMemoryPermission perm_mask, KMemoryPermission perm,
+                                         KMemoryAttribute attr_mask, KMemoryAttribute attr,
+                                         KMemoryPermission new_perm, KMemoryAttribute lock_attr) {
+    // Validate basic preconditions.
+    ASSERT((lock_attr & attr) == KMemoryAttribute::None);
+    ASSERT((lock_attr & (KMemoryAttribute::IpcLocked | KMemoryAttribute::DeviceShared)) ==
+           KMemoryAttribute::None);
+
+    // Validate the lock request.
+    const size_t num_pages = size / PageSize;
+    R_UNLESS(this->Contains(addr, size), ResultInvalidCurrentMemory);
+
+    // Lock the table.
+    KScopedLightLock lk(general_lock);
+
+    // Check that the output page group is empty, if it exists.
+    if (out_pg) {
+        ASSERT(out_pg->GetNumPages() == 0);
+    }
+
+    // Check the state.
+    KMemoryState old_state{};
+    KMemoryPermission old_perm{};
+    KMemoryAttribute old_attr{};
+    size_t num_allocator_blocks{};
+    R_TRY(this->CheckMemoryState(std::addressof(old_state), std::addressof(old_perm),
+                                 std::addressof(old_attr), std::addressof(num_allocator_blocks),
+                                 addr, size, state_mask | KMemoryState::FlagReferenceCounted,
+                                 state | KMemoryState::FlagReferenceCounted, perm_mask, perm,
+                                 attr_mask, attr));
+
+    // Get the physical address, if we're supposed to.
+    if (out_paddr != nullptr) {
+        ASSERT(this->GetPhysicalAddressLocked(out_paddr, addr));
+    }
+
+    // Make the page group, if we're supposed to.
+    if (out_pg != nullptr) {
+        R_TRY(this->MakePageGroup(*out_pg, addr, num_pages));
+    }
+
+    // Decide on new perm and attr.
+    new_perm = (new_perm != KMemoryPermission::None) ? new_perm : old_perm;
+    KMemoryAttribute new_attr = static_cast<KMemoryAttribute>(old_attr | lock_attr);
+
+    // Update permission, if we need to.
+    if (new_perm != old_perm) {
+        R_TRY(Operate(addr, num_pages, new_perm, OperationType::ChangePermissions));
+    }
+
+    // Apply the memory block updates.
+    block_manager->Update(addr, num_pages, old_state, new_perm, new_attr);
+
+    return ResultSuccess;
+}
+
+ResultCode KPageTable::UnlockMemory(VAddr addr, size_t size, KMemoryState state_mask,
+                                    KMemoryState state, KMemoryPermission perm_mask,
+                                    KMemoryPermission perm, KMemoryAttribute attr_mask,
+                                    KMemoryAttribute attr, KMemoryPermission new_perm,
+                                    KMemoryAttribute lock_attr, const KPageLinkedList* pg) {
+    // Validate basic preconditions.
+    ASSERT((attr_mask & lock_attr) == lock_attr);
+    ASSERT((attr & lock_attr) == lock_attr);
+
+    // Validate the unlock request.
+    const size_t num_pages = size / PageSize;
+    R_UNLESS(this->Contains(addr, size), ResultInvalidCurrentMemory);
+
+    // Lock the table.
+    KScopedLightLock lk(general_lock);
+
+    // Check the state.
+    KMemoryState old_state{};
+    KMemoryPermission old_perm{};
+    KMemoryAttribute old_attr{};
+    size_t num_allocator_blocks{};
+    R_TRY(this->CheckMemoryState(std::addressof(old_state), std::addressof(old_perm),
+                                 std::addressof(old_attr), std::addressof(num_allocator_blocks),
+                                 addr, size, state_mask | KMemoryState::FlagReferenceCounted,
+                                 state | KMemoryState::FlagReferenceCounted, perm_mask, perm,
+                                 attr_mask, attr));
+
+    // Check the page group.
+    if (pg != nullptr) {
+        UNIMPLEMENTED_MSG("PageGroup support is unimplemented!");
+    }
+
+    // Decide on new perm and attr.
+    new_perm = (new_perm != KMemoryPermission::None) ? new_perm : old_perm;
+    KMemoryAttribute new_attr = static_cast<KMemoryAttribute>(old_attr & ~lock_attr);
+
+    // Update permission, if we need to.
+    if (new_perm != old_perm) {
+        R_TRY(Operate(addr, num_pages, new_perm, OperationType::ChangePermissions));
+    }
+
+    // Apply the memory block updates.
+    block_manager->Update(addr, num_pages, old_state, new_perm, new_attr);
+
+    return ResultSuccess;
+}
+
 } // namespace Kernel
diff --git a/src/core/hle/kernel/k_page_table.h b/src/core/hle/kernel/k_page_table.h
index e99abe36a..dd6022975 100644
--- a/src/core/hle/kernel/k_page_table.h
+++ b/src/core/hle/kernel/k_page_table.h
@@ -12,6 +12,7 @@
 #include "core/file_sys/program_metadata.h"
 #include "core/hle/kernel/k_light_lock.h"
 #include "core/hle/kernel/k_memory_block.h"
+#include "core/hle/kernel/k_memory_layout.h"
 #include "core/hle/kernel/k_memory_manager.h"
 #include "core/hle/result.h"
 
@@ -25,6 +26,8 @@ class KMemoryBlockManager;
 
 class KPageTable final {
 public:
+    enum class ICacheInvalidationStrategy : u32 { InvalidateRange, InvalidateAll };
+
     YUZU_NON_COPYABLE(KPageTable);
     YUZU_NON_MOVEABLE(KPageTable);
 
@@ -37,7 +40,8 @@ public:
     ResultCode MapProcessCode(VAddr addr, std::size_t pages_count, KMemoryState state,
                               KMemoryPermission perm);
     ResultCode MapCodeMemory(VAddr dst_address, VAddr src_address, std::size_t size);
-    ResultCode UnmapCodeMemory(VAddr dst_address, VAddr src_address, std::size_t size);
+    ResultCode UnmapCodeMemory(VAddr dst_address, VAddr src_address, std::size_t size,
+                               ICacheInvalidationStrategy icache_invalidation_strategy);
     ResultCode UnmapProcessMemory(VAddr dst_addr, std::size_t size, KPageTable& src_page_table,
                                   VAddr src_addr);
     ResultCode MapPhysicalMemory(VAddr addr, std::size_t size);
@@ -46,7 +50,14 @@ public:
     ResultCode UnmapMemory(VAddr dst_addr, VAddr src_addr, std::size_t size);
     ResultCode MapPages(VAddr addr, KPageLinkedList& page_linked_list, KMemoryState state,
                         KMemoryPermission perm);
+    ResultCode MapPages(VAddr* out_addr, std::size_t num_pages, std::size_t alignment,
+                        PAddr phys_addr, KMemoryState state, KMemoryPermission perm) {
+        return this->MapPages(out_addr, num_pages, alignment, phys_addr, true,
+                              this->GetRegionAddress(state), this->GetRegionSize(state) / PageSize,
+                              state, perm);
+    }
     ResultCode UnmapPages(VAddr addr, KPageLinkedList& page_linked_list, KMemoryState state);
+    ResultCode UnmapPages(VAddr address, std::size_t num_pages, KMemoryState state);
     ResultCode SetProcessMemoryPermission(VAddr addr, std::size_t size,
                                           Svc::MemoryPermission svc_perm);
     KMemoryInfo QueryInfo(VAddr addr);
@@ -64,6 +75,10 @@ public:
     ResultCode UnlockForDeviceAddressSpace(VAddr addr, std::size_t size);
     ResultCode LockForCodeMemory(VAddr addr, std::size_t size);
     ResultCode UnlockForCodeMemory(VAddr addr, std::size_t size);
+    ResultCode MakeAndOpenPageGroup(KPageLinkedList* out, VAddr address, size_t num_pages,
+                                    KMemoryState state_mask, KMemoryState state,
+                                    KMemoryPermission perm_mask, KMemoryPermission perm,
+                                    KMemoryAttribute attr_mask, KMemoryAttribute attr);
 
     Common::PageTable& PageTableImpl() {
         return page_table_impl;
@@ -91,6 +106,9 @@ private:
     ResultCode InitializeMemoryLayout(VAddr start, VAddr end);
     ResultCode MapPages(VAddr addr, const KPageLinkedList& page_linked_list,
                         KMemoryPermission perm);
+    ResultCode MapPages(VAddr* out_addr, std::size_t num_pages, std::size_t alignment,
+                        PAddr phys_addr, bool is_pa_valid, VAddr region_start,
+                        std::size_t region_num_pages, KMemoryState state, KMemoryPermission perm);
     ResultCode UnmapPages(VAddr addr, const KPageLinkedList& page_linked_list);
     bool IsRegionMapped(VAddr address, u64 size);
     bool IsRegionContiguous(VAddr addr, u64 size) const;
@@ -105,6 +123,9 @@ private:
     VAddr GetRegionAddress(KMemoryState state) const;
     std::size_t GetRegionSize(KMemoryState state) const;
 
+    VAddr FindFreeArea(VAddr region_start, std::size_t region_num_pages, std::size_t num_pages,
+                       std::size_t alignment, std::size_t offset, std::size_t guard_pages);
+
     ResultCode CheckMemoryStateContiguous(std::size_t* out_blocks_needed, VAddr addr,
                                           std::size_t size, KMemoryState state_mask,
                                           KMemoryState state, KMemoryPermission perm_mask,
@@ -137,7 +158,7 @@ private:
         return CheckMemoryState(nullptr, nullptr, nullptr, out_blocks_needed, addr, size,
                                 state_mask, state, perm_mask, perm, attr_mask, attr, ignore_attr);
     }
-    ResultCode CheckMemoryState(VAddr addr, size_t size, KMemoryState state_mask,
+    ResultCode CheckMemoryState(VAddr addr, std::size_t size, KMemoryState state_mask,
                                 KMemoryState state, KMemoryPermission perm_mask,
                                 KMemoryPermission perm, KMemoryAttribute attr_mask,
                                 KMemoryAttribute attr,
@@ -146,10 +167,37 @@ private:
                                       attr_mask, attr, ignore_attr);
     }
 
+    ResultCode LockMemoryAndOpen(KPageLinkedList* out_pg, PAddr* out_paddr, VAddr addr, size_t size,
+                                 KMemoryState state_mask, KMemoryState state,
+                                 KMemoryPermission perm_mask, KMemoryPermission perm,
+                                 KMemoryAttribute attr_mask, KMemoryAttribute attr,
+                                 KMemoryPermission new_perm, KMemoryAttribute lock_attr);
+    ResultCode UnlockMemory(VAddr addr, size_t size, KMemoryState state_mask, KMemoryState state,
+                            KMemoryPermission perm_mask, KMemoryPermission perm,
+                            KMemoryAttribute attr_mask, KMemoryAttribute attr,
+                            KMemoryPermission new_perm, KMemoryAttribute lock_attr,
+                            const KPageLinkedList* pg);
+
+    ResultCode MakePageGroup(KPageLinkedList& pg, VAddr addr, size_t num_pages);
+
     bool IsLockedByCurrentThread() const {
         return general_lock.IsLockedByCurrentThread();
     }
 
+    bool IsHeapPhysicalAddress(const KMemoryLayout& layout, PAddr phys_addr) {
+        ASSERT(this->IsLockedByCurrentThread());
+
+        return layout.IsHeapPhysicalAddress(cached_physical_heap_region, phys_addr);
+    }
+
+    bool GetPhysicalAddressLocked(PAddr* out, VAddr virt_addr) const {
+        ASSERT(this->IsLockedByCurrentThread());
+
+        *out = GetPhysicalAddr(virt_addr);
+
+        return *out != 0;
+    }
+
     mutable KLightLock general_lock;
     mutable KLightLock map_physical_memory_lock;
 
@@ -210,7 +258,7 @@ public:
     constexpr VAddr GetAliasCodeRegionSize() const {
         return alias_code_region_end - alias_code_region_start;
     }
-    size_t GetNormalMemorySize() {
+    std::size_t GetNormalMemorySize() {
         KScopedLightLock lk(general_lock);
         return GetHeapSize() + mapped_physical_memory_size;
     }
@@ -309,6 +357,7 @@ private:
     bool is_aslr_enabled{};
 
     u32 heap_fill_value{};
+    const KMemoryRegion* cached_physical_heap_region{};
 
     KMemoryManager::Pool memory_pool{KMemoryManager::Pool::Application};
     KMemoryManager::Direction allocation_option{KMemoryManager::Direction::FromFront};
diff --git a/src/core/hle/kernel/k_port.cpp b/src/core/hle/kernel/k_port.cpp
index a8ba09c4a..ceb98709f 100644
--- a/src/core/hle/kernel/k_port.cpp
+++ b/src/core/hle/kernel/k_port.cpp
@@ -57,7 +57,12 @@ ResultCode KPort::EnqueueSession(KServerSession* session) {
     R_UNLESS(state == State::Normal, ResultPortClosed);
 
     server.EnqueueSession(session);
-    server.GetSessionRequestHandler()->ClientConnected(server.AcceptSession());
+
+    if (auto session_ptr = server.GetSessionRequestHandler().lock()) {
+        session_ptr->ClientConnected(server.AcceptSession());
+    } else {
+        UNREACHABLE();
+    }
 
     return ResultSuccess;
 }
diff --git a/src/core/hle/kernel/k_process.cpp b/src/core/hle/kernel/k_process.cpp
index 9233261cd..490e31fc7 100644
--- a/src/core/hle/kernel/k_process.cpp
+++ b/src/core/hle/kernel/k_process.cpp
@@ -13,7 +13,6 @@
 #include "common/scope_exit.h"
 #include "common/settings.h"
 #include "core/core.h"
-#include "core/device_memory.h"
 #include "core/file_sys/program_metadata.h"
 #include "core/hle/kernel/code_set.h"
 #include "core/hle/kernel/k_memory_block_manager.h"
@@ -24,7 +23,6 @@
 #include "core/hle/kernel/k_scoped_resource_reservation.h"
 #include "core/hle/kernel/k_shared_memory.h"
 #include "core/hle/kernel/k_shared_memory_info.h"
-#include "core/hle/kernel/k_slab_heap.h"
 #include "core/hle/kernel/k_thread.h"
 #include "core/hle/kernel/kernel.h"
 #include "core/hle/kernel/svc_results.h"
@@ -70,58 +68,6 @@ void SetupMainThread(Core::System& system, KProcess& owner_process, u32 priority
 }
 } // Anonymous namespace
 
-// Represents a page used for thread-local storage.
-//
-// Each TLS page contains slots that may be used by processes and threads.
-// Every process and thread is created with a slot in some arbitrary page
-// (whichever page happens to have an available slot).
-class TLSPage {
-public:
-    static constexpr std::size_t num_slot_entries =
-        Core::Memory::PAGE_SIZE / Core::Memory::TLS_ENTRY_SIZE;
-
-    explicit TLSPage(VAddr address) : base_address{address} {}
-
-    bool HasAvailableSlots() const {
-        return !is_slot_used.all();
-    }
-
-    VAddr GetBaseAddress() const {
-        return base_address;
-    }
-
-    std::optional<VAddr> ReserveSlot() {
-        for (std::size_t i = 0; i < is_slot_used.size(); i++) {
-            if (is_slot_used[i]) {
-                continue;
-            }
-
-            is_slot_used[i] = true;
-            return base_address + (i * Core::Memory::TLS_ENTRY_SIZE);
-        }
-
-        return std::nullopt;
-    }
-
-    void ReleaseSlot(VAddr address) {
-        // Ensure that all given addresses are consistent with how TLS pages
-        // are intended to be used when releasing slots.
-        ASSERT(IsWithinPage(address));
-        ASSERT((address % Core::Memory::TLS_ENTRY_SIZE) == 0);
-
-        const std::size_t index = (address - base_address) / Core::Memory::TLS_ENTRY_SIZE;
-        is_slot_used[index] = false;
-    }
-
-private:
-    bool IsWithinPage(VAddr address) const {
-        return base_address <= address && address < base_address + Core::Memory::PAGE_SIZE;
-    }
-
-    VAddr base_address;
-    std::bitset<num_slot_entries> is_slot_used;
-};
-
 ResultCode KProcess::Initialize(KProcess* process, Core::System& system, std::string process_name,
                                 ProcessType type, KResourceLimit* res_limit) {
     auto& kernel = system.Kernel();
@@ -404,7 +350,7 @@ ResultCode KProcess::LoadFromMetadata(const FileSys::ProgramMetadata& metadata,
     }
 
     // Create TLS region
-    tls_region_address = CreateTLSRegion();
+    R_TRY(this->CreateThreadLocalRegion(std::addressof(tls_region_address)));
     memory_reservation.Commit();
 
     return handle_table.Initialize(capabilities.GetHandleTableSize());
@@ -444,7 +390,7 @@ void KProcess::PrepareForTermination() {
 
     stop_threads(kernel.System().GlobalSchedulerContext().GetThreadList());
 
-    FreeTLSRegion(tls_region_address);
+    this->DeleteThreadLocalRegion(tls_region_address);
     tls_region_address = 0;
 
     if (resource_limit) {
@@ -456,9 +402,6 @@ void KProcess::PrepareForTermination() {
 }
 
 void KProcess::Finalize() {
-    // Finalize the handle table and close any open handles.
-    handle_table.Finalize();
-
     // Free all shared memory infos.
     {
         auto it = shared_memory_list.begin();
@@ -483,67 +426,110 @@ void KProcess::Finalize() {
         resource_limit = nullptr;
     }
 
+    // Finalize the page table.
+    page_table.reset();
+
     // Perform inherited finalization.
     KAutoObjectWithSlabHeapAndContainer<KProcess, KWorkerTask>::Finalize();
 }
 
-/**
- * Attempts to find a TLS page that contains a free slot for
- * use by a thread.
- *
- * @returns If a page with an available slot is found, then an iterator
- *          pointing to the page is returned. Otherwise the end iterator
- *          is returned instead.
- */
-static auto FindTLSPageWithAvailableSlots(std::vector<TLSPage>& tls_pages) {
-    return std::find_if(tls_pages.begin(), tls_pages.end(),
-                        [](const auto& page) { return page.HasAvailableSlots(); });
-}
+ResultCode KProcess::CreateThreadLocalRegion(VAddr* out) {
+    KThreadLocalPage* tlp = nullptr;
+    VAddr tlr = 0;
 
-VAddr KProcess::CreateTLSRegion() {
-    KScopedSchedulerLock lock(kernel);
-    if (auto tls_page_iter{FindTLSPageWithAvailableSlots(tls_pages)};
-        tls_page_iter != tls_pages.cend()) {
-        return *tls_page_iter->ReserveSlot();
-    }
+    // See if we can get a region from a partially used TLP.
+    {
+        KScopedSchedulerLock sl{kernel};
 
-    Page* const tls_page_ptr{kernel.GetUserSlabHeapPages().Allocate()};
-    ASSERT(tls_page_ptr);
+        if (auto it = partially_used_tlp_tree.begin(); it != partially_used_tlp_tree.end()) {
+            tlr = it->Reserve();
+            ASSERT(tlr != 0);
 
-    const VAddr start{page_table->GetKernelMapRegionStart()};
-    const VAddr size{page_table->GetKernelMapRegionEnd() - start};
-    const PAddr tls_map_addr{kernel.System().DeviceMemory().GetPhysicalAddr(tls_page_ptr)};
-    const VAddr tls_page_addr{page_table
-                                  ->AllocateAndMapMemory(1, PageSize, true, start, size / PageSize,
-                                                         KMemoryState::ThreadLocal,
-                                                         KMemoryPermission::UserReadWrite,
-                                                         tls_map_addr)
-                                  .ValueOr(0)};
+            if (it->IsAllUsed()) {
+                tlp = std::addressof(*it);
+                partially_used_tlp_tree.erase(it);
+                fully_used_tlp_tree.insert(*tlp);
+            }
 
-    ASSERT(tls_page_addr);
+            *out = tlr;
+            return ResultSuccess;
+        }
+    }
+
+    // Allocate a new page.
+    tlp = KThreadLocalPage::Allocate(kernel);
+    R_UNLESS(tlp != nullptr, ResultOutOfMemory);
+    auto tlp_guard = SCOPE_GUARD({ KThreadLocalPage::Free(kernel, tlp); });
+
+    // Initialize the new page.
+    R_TRY(tlp->Initialize(kernel, this));
 
-    std::memset(tls_page_ptr, 0, PageSize);
-    tls_pages.emplace_back(tls_page_addr);
+    // Reserve a TLR.
+    tlr = tlp->Reserve();
+    ASSERT(tlr != 0);
 
-    const auto reserve_result{tls_pages.back().ReserveSlot()};
-    ASSERT(reserve_result.has_value());
+    // Insert into our tree.
+    {
+        KScopedSchedulerLock sl{kernel};
+        if (tlp->IsAllUsed()) {
+            fully_used_tlp_tree.insert(*tlp);
+        } else {
+            partially_used_tlp_tree.insert(*tlp);
+        }
+    }
 
-    return *reserve_result;
+    // We succeeded!
+    tlp_guard.Cancel();
+    *out = tlr;
+    return ResultSuccess;
 }
 
-void KProcess::FreeTLSRegion(VAddr tls_address) {
-    KScopedSchedulerLock lock(kernel);
-    const VAddr aligned_address = Common::AlignDown(tls_address, Core::Memory::PAGE_SIZE);
-    auto iter =
-        std::find_if(tls_pages.begin(), tls_pages.end(), [aligned_address](const auto& page) {
-            return page.GetBaseAddress() == aligned_address;
-        });
+ResultCode KProcess::DeleteThreadLocalRegion(VAddr addr) {
+    KThreadLocalPage* page_to_free = nullptr;
 
-    // Something has gone very wrong if we're freeing a region
-    // with no actual page available.
-    ASSERT(iter != tls_pages.cend());
+    // Release the region.
+    {
+        KScopedSchedulerLock sl{kernel};
+
+        // Try to find the page in the partially used list.
+        auto it = partially_used_tlp_tree.find_key(Common::AlignDown(addr, PageSize));
+        if (it == partially_used_tlp_tree.end()) {
+            // If we don't find it, it has to be in the fully used list.
+            it = fully_used_tlp_tree.find_key(Common::AlignDown(addr, PageSize));
+            R_UNLESS(it != fully_used_tlp_tree.end(), ResultInvalidAddress);
+
+            // Release the region.
+            it->Release(addr);
+
+            // Move the page out of the fully used list.
+            KThreadLocalPage* tlp = std::addressof(*it);
+            fully_used_tlp_tree.erase(it);
+            if (tlp->IsAllFree()) {
+                page_to_free = tlp;
+            } else {
+                partially_used_tlp_tree.insert(*tlp);
+            }
+        } else {
+            // Release the region.
+            it->Release(addr);
+
+            // Handle the all-free case.
+            KThreadLocalPage* tlp = std::addressof(*it);
+            if (tlp->IsAllFree()) {
+                partially_used_tlp_tree.erase(it);
+                page_to_free = tlp;
+            }
+        }
+    }
+
+    // If we should free the page it was in, do so.
+    if (page_to_free != nullptr) {
+        page_to_free->Finalize();
 
-    iter->ReleaseSlot(tls_address);
+        KThreadLocalPage::Free(kernel, page_to_free);
+    }
+
+    return ResultSuccess;
 }
 
 void KProcess::LoadModule(CodeSet code_set, VAddr base_addr) {
diff --git a/src/core/hle/kernel/k_process.h b/src/core/hle/kernel/k_process.h
index cf1b67428..9f171e3da 100644
--- a/src/core/hle/kernel/k_process.h
+++ b/src/core/hle/kernel/k_process.h
@@ -8,13 +8,13 @@
 #include <cstddef>
 #include <list>
 #include <string>
-#include <vector>
 #include "common/common_types.h"
 #include "core/hle/kernel/k_address_arbiter.h"
 #include "core/hle/kernel/k_auto_object.h"
 #include "core/hle/kernel/k_condition_variable.h"
 #include "core/hle/kernel/k_handle_table.h"
 #include "core/hle/kernel/k_synchronization_object.h"
+#include "core/hle/kernel/k_thread_local_page.h"
 #include "core/hle/kernel/k_worker_task.h"
 #include "core/hle/kernel/process_capability.h"
 #include "core/hle/kernel/slab_helpers.h"
@@ -362,10 +362,10 @@ public:
     // Thread-local storage management
 
     // Marks the next available region as used and returns the address of the slot.
-    [[nodiscard]] VAddr CreateTLSRegion();
+    [[nodiscard]] ResultCode CreateThreadLocalRegion(VAddr* out);
 
     // Frees a used TLS slot identified by the given address
-    void FreeTLSRegion(VAddr tls_address);
+    ResultCode DeleteThreadLocalRegion(VAddr addr);
 
 private:
     void PinThread(s32 core_id, KThread* thread) {
@@ -413,13 +413,6 @@ private:
     /// The ideal CPU core for this process, threads are scheduled on this core by default.
     u8 ideal_core = 0;
 
-    /// The Thread Local Storage area is allocated as processes create threads,
-    /// each TLS area is 0x200 bytes, so one page (0x1000) is split up in 8 parts, and each part
-    /// holds the TLS for a specific thread. This vector contains which parts are in use for each
-    /// page as a bitmask.
-    /// This vector will grow as more pages are allocated for new threads.
-    std::vector<TLSPage> tls_pages;
-
     /// Contains the parsed process capability descriptors.
     ProcessCapabilities capabilities;
 
@@ -429,7 +422,7 @@ private:
     bool is_64bit_process = true;
 
     /// Total running time for the process in ticks.
-    u64 total_process_running_time_ticks = 0;
+    std::atomic<u64> total_process_running_time_ticks = 0;
 
     /// Per-process handle table for storing created object handles in.
     KHandleTable handle_table;
@@ -482,6 +475,12 @@ private:
     KThread* exception_thread{};
 
     KLightLock state_lock;
+
+    using TLPTree =
+        Common::IntrusiveRedBlackTreeBaseTraits<KThreadLocalPage>::TreeType<KThreadLocalPage>;
+    using TLPIterator = TLPTree::iterator;
+    TLPTree fully_used_tlp_tree;
+    TLPTree partially_used_tlp_tree;
 };
 
 } // namespace Kernel
diff --git a/src/core/hle/kernel/k_scheduler.cpp b/src/core/hle/kernel/k_scheduler.cpp
index c96520828..6c0bb1672 100644
--- a/src/core/hle/kernel/k_scheduler.cpp
+++ b/src/core/hle/kernel/k_scheduler.cpp
@@ -22,7 +22,6 @@
 #include "core/hle/kernel/k_thread.h"
 #include "core/hle/kernel/kernel.h"
 #include "core/hle/kernel/physical_core.h"
-#include "core/hle/kernel/time_manager.h"
 
 namespace Kernel {
 
diff --git a/src/core/hle/kernel/k_scheduler_lock.h b/src/core/hle/kernel/k_scheduler_lock.h
index 93c47f1b1..016e0a818 100644
--- a/src/core/hle/kernel/k_scheduler_lock.h
+++ b/src/core/hle/kernel/k_scheduler_lock.h
@@ -4,6 +4,7 @@
 
 #pragma once
 
+#include <atomic>
 #include "common/assert.h"
 #include "core/hle/kernel/k_spin_lock.h"
 #include "core/hle/kernel/k_thread.h"
@@ -75,7 +76,7 @@ private:
     KernelCore& kernel;
     KAlignedSpinLock spin_lock{};
     s32 lock_count{};
-    KThread* owner_thread{};
+    std::atomic<KThread*> owner_thread{};
 };
 
 } // namespace Kernel
diff --git a/src/core/hle/kernel/k_server_port.cpp b/src/core/hle/kernel/k_server_port.cpp
index 433fc98e1..e66c0c992 100644
--- a/src/core/hle/kernel/k_server_port.cpp
+++ b/src/core/hle/kernel/k_server_port.cpp
@@ -62,6 +62,12 @@ void KServerPort::Destroy() {
 
     // Close our reference to our parent.
     parent->Close();
+
+    // Release host emulation members.
+    session_handler.reset();
+
+    // Ensure that the global list tracking server objects does not hold on to a reference.
+    kernel.UnregisterServerObject(this);
 }
 
 bool KServerPort::IsSignaled() const {
diff --git a/src/core/hle/kernel/k_server_port.h b/src/core/hle/kernel/k_server_port.h
index 6302d5e61..2185736be 100644
--- a/src/core/hle/kernel/k_server_port.h
+++ b/src/core/hle/kernel/k_server_port.h
@@ -30,11 +30,11 @@ public:
 
     /// Whether or not this server port has an HLE handler available.
     bool HasSessionRequestHandler() const {
-        return session_handler != nullptr;
+        return !session_handler.expired();
     }
 
     /// Gets the HLE handler for this port.
-    SessionRequestHandlerPtr GetSessionRequestHandler() const {
+    SessionRequestHandlerWeakPtr GetSessionRequestHandler() const {
         return session_handler;
     }
 
@@ -42,7 +42,7 @@ public:
      * Sets the HLE handler template for the port. ServerSessions crated by connecting to this port
      * will inherit a reference to this handler.
      */
-    void SetSessionHandler(SessionRequestHandlerPtr&& handler) {
+    void SetSessionHandler(SessionRequestHandlerWeakPtr&& handler) {
         session_handler = std::move(handler);
     }
 
@@ -66,7 +66,7 @@ private:
     void CleanupSessions();
 
     SessionList session_list;
-    SessionRequestHandlerPtr session_handler;
+    SessionRequestHandlerWeakPtr session_handler;
     KPort* parent{};
 };
 
diff --git a/src/core/hle/kernel/k_server_session.cpp b/src/core/hle/kernel/k_server_session.cpp
index 4d94eb9cf..7ac2ef254 100644
--- a/src/core/hle/kernel/k_server_session.cpp
+++ b/src/core/hle/kernel/k_server_session.cpp
@@ -27,10 +27,7 @@ namespace Kernel {
 
 KServerSession::KServerSession(KernelCore& kernel_) : KSynchronizationObject{kernel_} {}
 
-KServerSession::~KServerSession() {
-    // Ensure that the global list tracking server sessions does not hold on to a reference.
-    kernel.UnregisterServerSession(this);
-}
+KServerSession::~KServerSession() = default;
 
 void KServerSession::Initialize(KSession* parent_session_, std::string&& name_,
                                 std::shared_ptr<SessionRequestManager> manager_) {
@@ -49,6 +46,12 @@ void KServerSession::Destroy() {
     parent->OnServerClosed();
 
     parent->Close();
+
+    // Release host emulation members.
+    manager.reset();
+
+    // Ensure that the global list tracking server objects does not hold on to a reference.
+    kernel.UnregisterServerObject(this);
 }
 
 void KServerSession::OnClientClosed() {
@@ -98,7 +101,12 @@ ResultCode KServerSession::HandleDomainSyncRequest(Kernel::HLERequestContext& co
             UNREACHABLE();
             return ResultSuccess; // Ignore error if asserts are off
         }
-        return manager->DomainHandler(object_id - 1)->HandleSyncRequest(*this, context);
+        if (auto strong_ptr = manager->DomainHandler(object_id - 1).lock()) {
+            return strong_ptr->HandleSyncRequest(*this, context);
+        } else {
+            UNREACHABLE();
+            return ResultSuccess;
+        }
 
     case IPC::DomainMessageHeader::CommandType::CloseVirtualHandle: {
         LOG_DEBUG(IPC, "CloseVirtualHandle, object_id=0x{:08X}", object_id);
diff --git a/src/core/hle/kernel/k_slab_heap.h b/src/core/hle/kernel/k_slab_heap.h
index 05c0bec9c..5690cc757 100644
--- a/src/core/hle/kernel/k_slab_heap.h
+++ b/src/core/hle/kernel/k_slab_heap.h
@@ -16,39 +16,34 @@ class KernelCore;
 
 namespace impl {
 
-class KSlabHeapImpl final {
-public:
+class KSlabHeapImpl {
     YUZU_NON_COPYABLE(KSlabHeapImpl);
     YUZU_NON_MOVEABLE(KSlabHeapImpl);
 
+public:
     struct Node {
         Node* next{};
     };
 
+public:
     constexpr KSlabHeapImpl() = default;
-    constexpr ~KSlabHeapImpl() = default;
 
-    void Initialize(std::size_t size) {
-        ASSERT(head == nullptr);
-        obj_size = size;
-    }
-
-    constexpr std::size_t GetObjectSize() const {
-        return obj_size;
+    void Initialize() {
+        ASSERT(m_head == nullptr);
     }
 
     Node* GetHead() const {
-        return head;
+        return m_head;
     }
 
     void* Allocate() {
-        Node* ret = head.load();
+        Node* ret = m_head.load();
 
         do {
             if (ret == nullptr) {
                 break;
             }
-        } while (!head.compare_exchange_weak(ret, ret->next));
+        } while (!m_head.compare_exchange_weak(ret, ret->next));
 
         return ret;
     }
@@ -56,170 +51,157 @@ public:
     void Free(void* obj) {
         Node* node = static_cast<Node*>(obj);
 
-        Node* cur_head = head.load();
+        Node* cur_head = m_head.load();
         do {
             node->next = cur_head;
-        } while (!head.compare_exchange_weak(cur_head, node));
+        } while (!m_head.compare_exchange_weak(cur_head, node));
     }
 
 private:
-    std::atomic<Node*> head{};
-    std::size_t obj_size{};
+    std::atomic<Node*> m_head{};
 };
 
 } // namespace impl
 
-class KSlabHeapBase {
-public:
+template <bool SupportDynamicExpansion>
+class KSlabHeapBase : protected impl::KSlabHeapImpl {
     YUZU_NON_COPYABLE(KSlabHeapBase);
     YUZU_NON_MOVEABLE(KSlabHeapBase);
 
-    constexpr KSlabHeapBase() = default;
-    constexpr ~KSlabHeapBase() = default;
+private:
+    size_t m_obj_size{};
+    uintptr_t m_peak{};
+    uintptr_t m_start{};
+    uintptr_t m_end{};
 
-    constexpr bool Contains(uintptr_t addr) const {
-        return start <= addr && addr < end;
-    }
+private:
+    void UpdatePeakImpl(uintptr_t obj) {
+        static_assert(std::atomic_ref<uintptr_t>::is_always_lock_free);
+        std::atomic_ref<uintptr_t> peak_ref(m_peak);
 
-    constexpr std::size_t GetSlabHeapSize() const {
-        return (end - start) / GetObjectSize();
+        const uintptr_t alloc_peak = obj + this->GetObjectSize();
+        uintptr_t cur_peak = m_peak;
+        do {
+            if (alloc_peak <= cur_peak) {
+                break;
+            }
+        } while (!peak_ref.compare_exchange_strong(cur_peak, alloc_peak));
     }
 
-    constexpr std::size_t GetObjectSize() const {
-        return impl.GetObjectSize();
-    }
+public:
+    constexpr KSlabHeapBase() = default;
 
-    constexpr uintptr_t GetSlabHeapAddress() const {
-        return start;
+    bool Contains(uintptr_t address) const {
+        return m_start <= address && address < m_end;
     }
 
-    std::size_t GetObjectIndexImpl(const void* obj) const {
-        return (reinterpret_cast<uintptr_t>(obj) - start) / GetObjectSize();
+    void Initialize(size_t obj_size, void* memory, size_t memory_size) {
+        // Ensure we don't initialize a slab using null memory.
+        ASSERT(memory != nullptr);
+
+        // Set our object size.
+        m_obj_size = obj_size;
+
+        // Initialize the base allocator.
+        KSlabHeapImpl::Initialize();
+
+        // Set our tracking variables.
+        const size_t num_obj = (memory_size / obj_size);
+        m_start = reinterpret_cast<uintptr_t>(memory);
+        m_end = m_start + num_obj * obj_size;
+        m_peak = m_start;
+
+        // Free the objects.
+        u8* cur = reinterpret_cast<u8*>(m_end);
+
+        for (size_t i = 0; i < num_obj; i++) {
+            cur -= obj_size;
+            KSlabHeapImpl::Free(cur);
+        }
     }
 
-    std::size_t GetPeakIndex() const {
-        return GetObjectIndexImpl(reinterpret_cast<const void*>(peak));
+    size_t GetSlabHeapSize() const {
+        return (m_end - m_start) / this->GetObjectSize();
     }
 
-    void* AllocateImpl() {
-        return impl.Allocate();
+    size_t GetObjectSize() const {
+        return m_obj_size;
     }
 
-    void FreeImpl(void* obj) {
-        // Don't allow freeing an object that wasn't allocated from this heap
-        ASSERT(Contains(reinterpret_cast<uintptr_t>(obj)));
+    void* Allocate() {
+        void* obj = KSlabHeapImpl::Allocate();
 
-        impl.Free(obj);
+        return obj;
     }
 
-    void InitializeImpl(std::size_t obj_size, void* memory, std::size_t memory_size) {
-        // Ensure we don't initialize a slab using null memory
-        ASSERT(memory != nullptr);
-
-        // Initialize the base allocator
-        impl.Initialize(obj_size);
+    void Free(void* obj) {
+        // Don't allow freeing an object that wasn't allocated from this heap.
+        const bool contained = this->Contains(reinterpret_cast<uintptr_t>(obj));
+        ASSERT(contained);
+        KSlabHeapImpl::Free(obj);
+    }
 
-        // Set our tracking variables
-        const std::size_t num_obj = (memory_size / obj_size);
-        start = reinterpret_cast<uintptr_t>(memory);
-        end = start + num_obj * obj_size;
-        peak = start;
+    size_t GetObjectIndex(const void* obj) const {
+        if constexpr (SupportDynamicExpansion) {
+            if (!this->Contains(reinterpret_cast<uintptr_t>(obj))) {
+                return std::numeric_limits<size_t>::max();
+            }
+        }
 
-        // Free the objects
-        u8* cur = reinterpret_cast<u8*>(end);
+        return (reinterpret_cast<uintptr_t>(obj) - m_start) / this->GetObjectSize();
+    }
 
-        for (std::size_t i{}; i < num_obj; i++) {
-            cur -= obj_size;
-            impl.Free(cur);
-        }
+    size_t GetPeakIndex() const {
+        return this->GetObjectIndex(reinterpret_cast<const void*>(m_peak));
     }
 
-private:
-    using Impl = impl::KSlabHeapImpl;
+    uintptr_t GetSlabHeapAddress() const {
+        return m_start;
+    }
 
-    Impl impl;
-    uintptr_t peak{};
-    uintptr_t start{};
-    uintptr_t end{};
+    size_t GetNumRemaining() const {
+        // Only calculate the number of remaining objects under debug configuration.
+        return 0;
+    }
 };
 
 template <typename T>
-class KSlabHeap final : public KSlabHeapBase {
-public:
-    enum class AllocationType {
-        Host,
-        Guest,
-    };
+class KSlabHeap final : public KSlabHeapBase<false> {
+private:
+    using BaseHeap = KSlabHeapBase<false>;
 
-    explicit constexpr KSlabHeap(AllocationType allocation_type_ = AllocationType::Host)
-        : KSlabHeapBase(), allocation_type{allocation_type_} {}
+public:
+    constexpr KSlabHeap() = default;
 
-    void Initialize(void* memory, std::size_t memory_size) {
-        if (allocation_type == AllocationType::Guest) {
-            InitializeImpl(sizeof(T), memory, memory_size);
-        }
+    void Initialize(void* memory, size_t memory_size) {
+        BaseHeap::Initialize(sizeof(T), memory, memory_size);
     }
 
     T* Allocate() {
-        switch (allocation_type) {
-        case AllocationType::Host:
-            // Fallback for cases where we do not yet support allocating guest memory from the slab
-            // heap, such as for kernel memory regions.
-            return new T;
-
-        case AllocationType::Guest:
-            T* obj = static_cast<T*>(AllocateImpl());
-            if (obj != nullptr) {
-                new (obj) T();
-            }
-            return obj;
-        }
+        T* obj = static_cast<T*>(BaseHeap::Allocate());
 
-        UNREACHABLE_MSG("Invalid AllocationType {}", allocation_type);
-        return nullptr;
+        if (obj != nullptr) [[likely]] {
+            std::construct_at(obj);
+        }
+        return obj;
     }
 
-    T* AllocateWithKernel(KernelCore& kernel) {
-        switch (allocation_type) {
-        case AllocationType::Host:
-            // Fallback for cases where we do not yet support allocating guest memory from the slab
-            // heap, such as for kernel memory regions.
-            return new T(kernel);
+    T* Allocate(KernelCore& kernel) {
+        T* obj = static_cast<T*>(BaseHeap::Allocate());
 
-        case AllocationType::Guest:
-            T* obj = static_cast<T*>(AllocateImpl());
-            if (obj != nullptr) {
-                new (obj) T(kernel);
-            }
-            return obj;
+        if (obj != nullptr) [[likely]] {
+            std::construct_at(obj, kernel);
         }
-
-        UNREACHABLE_MSG("Invalid AllocationType {}", allocation_type);
-        return nullptr;
+        return obj;
     }
 
     void Free(T* obj) {
-        switch (allocation_type) {
-        case AllocationType::Host:
-            // Fallback for cases where we do not yet support allocating guest memory from the slab
-            // heap, such as for kernel memory regions.
-            delete obj;
-            return;
-
-        case AllocationType::Guest:
-            FreeImpl(obj);
-            return;
-        }
-
-        UNREACHABLE_MSG("Invalid AllocationType {}", allocation_type);
+        BaseHeap::Free(obj);
     }
 
-    constexpr std::size_t GetObjectIndex(const T* obj) const {
-        return GetObjectIndexImpl(obj);
+    size_t GetObjectIndex(const T* obj) const {
+        return BaseHeap::GetObjectIndex(obj);
     }
-
-private:
-    const AllocationType allocation_type;
 };
 
 } // namespace Kernel
diff --git a/src/core/hle/kernel/k_thread.cpp b/src/core/hle/kernel/k_thread.cpp
index de3ffe0c7..d3bb1c871 100644
--- a/src/core/hle/kernel/k_thread.cpp
+++ b/src/core/hle/kernel/k_thread.cpp
@@ -14,9 +14,7 @@
 #include "common/common_types.h"
 #include "common/fiber.h"
 #include "common/logging/log.h"
-#include "common/scope_exit.h"
 #include "common/settings.h"
-#include "common/thread_queue_list.h"
 #include "core/core.h"
 #include "core/cpu_manager.h"
 #include "core/hardware_properties.h"
@@ -33,7 +31,6 @@
 #include "core/hle/kernel/k_worker_task_manager.h"
 #include "core/hle/kernel/kernel.h"
 #include "core/hle/kernel/svc_results.h"
-#include "core/hle/kernel/time_manager.h"
 #include "core/hle/result.h"
 #include "core/memory.h"
 
@@ -210,7 +207,7 @@ ResultCode KThread::Initialize(KThreadFunction func, uintptr_t arg, VAddr user_s
     if (owner != nullptr) {
         // Setup the TLS, if needed.
         if (type == ThreadType::User) {
-            tls_address = owner->CreateTLSRegion();
+            R_TRY(owner->CreateThreadLocalRegion(std::addressof(tls_address)));
         }
 
         parent = owner;
@@ -305,7 +302,7 @@ void KThread::Finalize() {
 
     // If the thread has a local region, delete it.
     if (tls_address != 0) {
-        parent->FreeTLSRegion(tls_address);
+        ASSERT(parent->DeleteThreadLocalRegion(tls_address).IsSuccess());
     }
 
     // Release any waiters.
@@ -326,6 +323,9 @@ void KThread::Finalize() {
         }
     }
 
+    // Release host emulation members.
+    host_context.reset();
+
     // Perform inherited finalization.
     KSynchronizationObject::Finalize();
 }
@@ -723,7 +723,7 @@ void KThread::UpdateState() {
     ASSERT(kernel.GlobalSchedulerContext().IsLocked());
 
     // Set our suspend flags in state.
-    const auto old_state = thread_state;
+    const ThreadState old_state = thread_state;
     const auto new_state =
         static_cast<ThreadState>(this->GetSuspendFlags()) | (old_state & ThreadState::Mask);
     thread_state = new_state;
@@ -738,7 +738,7 @@ void KThread::Continue() {
     ASSERT(kernel.GlobalSchedulerContext().IsLocked());
 
     // Clear our suspend flags in state.
-    const auto old_state = thread_state;
+    const ThreadState old_state = thread_state;
     thread_state = old_state & ThreadState::Mask;
 
     // Note the state change in scheduler.
diff --git a/src/core/hle/kernel/k_thread.h b/src/core/hle/kernel/k_thread.h
index d058db62c..d0fd85130 100644
--- a/src/core/hle/kernel/k_thread.h
+++ b/src/core/hle/kernel/k_thread.h
@@ -5,6 +5,7 @@
 #pragma once
 
 #include <array>
+#include <atomic>
 #include <span>
 #include <string>
 #include <utility>
@@ -656,7 +657,7 @@ private:
     static_assert(sizeof(SyncObjectBuffer::sync_objects) == sizeof(SyncObjectBuffer::handles));
 
     struct ConditionVariableComparator {
-        struct LightCompareType {
+        struct RedBlackKeyType {
             u64 cv_key{};
             s32 priority{};
 
@@ -672,8 +673,8 @@ private:
         template <typename T>
         requires(
             std::same_as<T, KThread> ||
-            std::same_as<T, LightCompareType>) static constexpr int Compare(const T& lhs,
-                                                                            const KThread& rhs) {
+            std::same_as<T, RedBlackKeyType>) static constexpr int Compare(const T& lhs,
+                                                                           const KThread& rhs) {
             const u64 l_key = lhs.GetConditionVariableKey();
             const u64 r_key = rhs.GetConditionVariableKey();
 
@@ -751,7 +752,7 @@ private:
     KAffinityMask original_physical_affinity_mask{};
     s32 original_physical_ideal_core_id{};
     s32 num_core_migration_disables{};
-    ThreadState thread_state{};
+    std::atomic<ThreadState> thread_state{};
     std::atomic<bool> termination_requested{};
     bool wait_cancelled{};
     bool cancellable{};
diff --git a/src/core/hle/kernel/k_thread_local_page.cpp b/src/core/hle/kernel/k_thread_local_page.cpp
new file mode 100644
index 000000000..3fb277eba
--- /dev/null
+++ b/src/core/hle/kernel/k_thread_local_page.cpp
@@ -0,0 +1,68 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#include "common/scope_exit.h"
+#include "core/core.h"
+
+#include "core/hle/kernel/k_memory_block.h"
+#include "core/hle/kernel/k_page_buffer.h"
+#include "core/hle/kernel/k_page_table.h"
+#include "core/hle/kernel/k_process.h"
+#include "core/hle/kernel/k_thread_local_page.h"
+#include "core/hle/kernel/kernel.h"
+
+namespace Kernel {
+
+ResultCode KThreadLocalPage::Initialize(KernelCore& kernel, KProcess* process) {
+    // Set that this process owns us.
+    m_owner = process;
+    m_kernel = &kernel;
+
+    // Allocate a new page.
+    KPageBuffer* page_buf = KPageBuffer::Allocate(kernel);
+    R_UNLESS(page_buf != nullptr, ResultOutOfMemory);
+    auto page_buf_guard = SCOPE_GUARD({ KPageBuffer::Free(kernel, page_buf); });
+
+    // Map the address in.
+    const auto phys_addr = kernel.System().DeviceMemory().GetPhysicalAddr(page_buf);
+    R_TRY(m_owner->PageTable().MapPages(std::addressof(m_virt_addr), 1, PageSize, phys_addr,
+                                        KMemoryState::ThreadLocal,
+                                        KMemoryPermission::UserReadWrite));
+
+    // We succeeded.
+    page_buf_guard.Cancel();
+
+    return ResultSuccess;
+}
+
+ResultCode KThreadLocalPage::Finalize() {
+    // Get the physical address of the page.
+    const PAddr phys_addr = m_owner->PageTable().GetPhysicalAddr(m_virt_addr);
+    ASSERT(phys_addr);
+
+    // Unmap the page.
+    R_TRY(m_owner->PageTable().UnmapPages(this->GetAddress(), 1, KMemoryState::ThreadLocal));
+
+    // Free the page.
+    KPageBuffer::Free(*m_kernel, KPageBuffer::FromPhysicalAddress(m_kernel->System(), phys_addr));
+
+    return ResultSuccess;
+}
+
+VAddr KThreadLocalPage::Reserve() {
+    for (size_t i = 0; i < m_is_region_free.size(); i++) {
+        if (m_is_region_free[i]) {
+            m_is_region_free[i] = false;
+            return this->GetRegionAddress(i);
+        }
+    }
+
+    return 0;
+}
+
+void KThreadLocalPage::Release(VAddr addr) {
+    m_is_region_free[this->GetRegionIndex(addr)] = true;
+}
+
+} // namespace Kernel
diff --git a/src/core/hle/kernel/k_thread_local_page.h b/src/core/hle/kernel/k_thread_local_page.h
new file mode 100644
index 000000000..74b565a71
--- /dev/null
+++ b/src/core/hle/kernel/k_thread_local_page.h
@@ -0,0 +1,111 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#pragma once
+
+#include <algorithm>
+#include <array>
+
+#include "common/alignment.h"
+#include "common/assert.h"
+#include "common/common_types.h"
+#include "common/intrusive_red_black_tree.h"
+#include "core/hle/kernel/memory_types.h"
+#include "core/hle/kernel/slab_helpers.h"
+#include "core/hle/result.h"
+
+namespace Kernel {
+
+class KernelCore;
+class KProcess;
+
+class KThreadLocalPage final : public Common::IntrusiveRedBlackTreeBaseNode<KThreadLocalPage>,
+                               public KSlabAllocated<KThreadLocalPage> {
+public:
+    static constexpr size_t RegionsPerPage = PageSize / Svc::ThreadLocalRegionSize;
+    static_assert(RegionsPerPage > 0);
+
+public:
+    constexpr explicit KThreadLocalPage(VAddr addr = {}) : m_virt_addr(addr) {
+        m_is_region_free.fill(true);
+    }
+
+    constexpr VAddr GetAddress() const {
+        return m_virt_addr;
+    }
+
+    ResultCode Initialize(KernelCore& kernel, KProcess* process);
+    ResultCode Finalize();
+
+    VAddr Reserve();
+    void Release(VAddr addr);
+
+    bool IsAllUsed() const {
+        return std::ranges::all_of(m_is_region_free.begin(), m_is_region_free.end(),
+                                   [](bool is_free) { return !is_free; });
+    }
+
+    bool IsAllFree() const {
+        return std::ranges::all_of(m_is_region_free.begin(), m_is_region_free.end(),
+                                   [](bool is_free) { return is_free; });
+    }
+
+    bool IsAnyUsed() const {
+        return !this->IsAllFree();
+    }
+
+    bool IsAnyFree() const {
+        return !this->IsAllUsed();
+    }
+
+public:
+    using RedBlackKeyType = VAddr;
+
+    static constexpr RedBlackKeyType GetRedBlackKey(const RedBlackKeyType& v) {
+        return v;
+    }
+    static constexpr RedBlackKeyType GetRedBlackKey(const KThreadLocalPage& v) {
+        return v.GetAddress();
+    }
+
+    template <typename T>
+    requires(std::same_as<T, KThreadLocalPage> ||
+             std::same_as<T, RedBlackKeyType>) static constexpr int Compare(const T& lhs,
+                                                                            const KThreadLocalPage&
+                                                                                rhs) {
+        const VAddr lval = GetRedBlackKey(lhs);
+        const VAddr rval = GetRedBlackKey(rhs);
+
+        if (lval < rval) {
+            return -1;
+        } else if (lval == rval) {
+            return 0;
+        } else {
+            return 1;
+        }
+    }
+
+private:
+    constexpr VAddr GetRegionAddress(size_t i) const {
+        return this->GetAddress() + i * Svc::ThreadLocalRegionSize;
+    }
+
+    constexpr bool Contains(VAddr addr) const {
+        return this->GetAddress() <= addr && addr < this->GetAddress() + PageSize;
+    }
+
+    constexpr size_t GetRegionIndex(VAddr addr) const {
+        ASSERT(Common::IsAligned(addr, Svc::ThreadLocalRegionSize));
+        ASSERT(this->Contains(addr));
+        return (addr - this->GetAddress()) / Svc::ThreadLocalRegionSize;
+    }
+
+private:
+    VAddr m_virt_addr{};
+    KProcess* m_owner{};
+    KernelCore* m_kernel{};
+    std::array<bool, RegionsPerPage> m_is_region_free{};
+};
+
+} // namespace Kernel
diff --git a/src/core/hle/kernel/kernel.cpp b/src/core/hle/kernel/kernel.cpp
index 71bd466cf..d840d44e6 100644
--- a/src/core/hle/kernel/kernel.cpp
+++ b/src/core/hle/kernel/kernel.cpp
@@ -22,9 +22,7 @@
 #include "core/arm/exclusive_monitor.h"
 #include "core/core.h"
 #include "core/core_timing.h"
-#include "core/core_timing_util.h"
 #include "core/cpu_manager.h"
-#include "core/device_memory.h"
 #include "core/hardware_properties.h"
 #include "core/hle/kernel/init/init_slab_setup.h"
 #include "core/hle/kernel/k_client_port.h"
@@ -35,7 +33,6 @@
 #include "core/hle/kernel/k_resource_limit.h"
 #include "core/hle/kernel/k_scheduler.h"
 #include "core/hle/kernel/k_shared_memory.h"
-#include "core/hle/kernel/k_slab_heap.h"
 #include "core/hle/kernel/k_thread.h"
 #include "core/hle/kernel/k_worker_task_manager.h"
 #include "core/hle/kernel/kernel.h"
@@ -52,7 +49,7 @@ namespace Kernel {
 
 struct KernelCore::Impl {
     explicit Impl(Core::System& system_, KernelCore& kernel_)
-        : time_manager{system_}, object_list_container{kernel_},
+        : time_manager{system_},
           service_threads_manager{1, "yuzu:ServiceThreadsManager"}, system{system_} {}
 
     void SetMulticore(bool is_multi) {
@@ -60,9 +57,11 @@ struct KernelCore::Impl {
     }
 
     void Initialize(KernelCore& kernel) {
+        global_object_list_container = std::make_unique<KAutoObjectWithListContainer>(kernel);
         global_scheduler_context = std::make_unique<Kernel::GlobalSchedulerContext>(kernel);
         global_handle_table = std::make_unique<Kernel::KHandleTable>(kernel);
         global_handle_table->Initialize(KHandleTable::MaxTableSize);
+        default_service_thread = CreateServiceThread(kernel, "DefaultServiceThread");
 
         is_phantom_mode_for_singlecore = false;
 
@@ -76,7 +75,7 @@ struct KernelCore::Impl {
         // Initialize kernel memory and resources.
         InitializeSystemResourceLimit(kernel, system.CoreTiming());
         InitializeMemoryLayout();
-        InitializePageSlab();
+        Init::InitializeKPageBufferSlabHeap(system);
         InitializeSchedulers();
         InitializeSuspendThreads();
         InitializePreemption(kernel);
@@ -86,7 +85,7 @@ struct KernelCore::Impl {
 
     void InitializeCores() {
         for (u32 core_id = 0; core_id < Core::Hardware::NUM_CPU_CORES; core_id++) {
-            cores[core_id].Initialize(current_process->Is64BitProcess());
+            cores[core_id].Initialize((*current_process).Is64BitProcess());
             system.Memory().SetCurrentPageTable(*current_process, core_id);
         }
     }
@@ -97,30 +96,17 @@ struct KernelCore::Impl {
 
         process_list.clear();
 
-        // Close all open server ports.
-        std::unordered_set<KServerPort*> server_ports_;
+        // Close all open server sessions and ports.
+        std::unordered_set<KAutoObject*> server_objects_;
         {
-            std::lock_guard lk(server_ports_lock);
-            server_ports_ = server_ports;
-            server_ports.clear();
+            std::scoped_lock lk(server_objects_lock);
+            server_objects_ = server_objects;
+            server_objects.clear();
         }
-        for (auto* server_port : server_ports_) {
-            server_port->Close();
-        }
-        // Close all open server sessions.
-        std::unordered_set<KServerSession*> server_sessions_;
-        {
-            std::lock_guard lk(server_sessions_lock);
-            server_sessions_ = server_sessions;
-            server_sessions.clear();
-        }
-        for (auto* server_session : server_sessions_) {
-            server_session->Close();
+        for (auto* server_object : server_objects_) {
+            server_object->Close();
         }
 
-        // Ensure that the object list container is finalized and properly shutdown.
-        object_list_container.Finalize();
-
         // Ensures all service threads gracefully shutdown.
         ClearServiceThreads();
 
@@ -171,7 +157,7 @@ struct KernelCore::Impl {
 
         // Close kernel objects that were not freed on shutdown
         {
-            std::lock_guard lk(registered_in_use_objects_lock);
+            std::scoped_lock lk{registered_in_use_objects_lock};
             if (registered_in_use_objects.size()) {
                 for (auto& object : registered_in_use_objects) {
                     object->Close();
@@ -182,23 +168,27 @@ struct KernelCore::Impl {
 
         // Shutdown all processes.
         if (current_process) {
-            current_process->Finalize();
+            (*current_process).Finalize();
             // current_process->Close();
             // TODO: The current process should be destroyed based on accurate ref counting after
             // calling Close(). Adding a manual Destroy() call instead to avoid a memory leak.
-            current_process->Destroy();
+            (*current_process).Destroy();
             current_process = nullptr;
         }
 
         // Track kernel objects that were not freed on shutdown
         {
-            std::lock_guard lk(registered_objects_lock);
+            std::scoped_lock lk{registered_objects_lock};
             if (registered_objects.size()) {
-                LOG_WARNING(Kernel, "{} kernel objects were dangling on shutdown!",
-                            registered_objects.size());
+                LOG_DEBUG(Kernel, "{} kernel objects were dangling on shutdown!",
+                          registered_objects.size());
                 registered_objects.clear();
             }
         }
+
+        // Ensure that the object list container is finalized and properly shutdown.
+        global_object_list_container->Finalize();
+        global_object_list_container.reset();
     }
 
     void InitializePhysicalCores() {
@@ -291,15 +281,16 @@ struct KernelCore::Impl {
 
     // Gets the dummy KThread for the caller, allocating a new one if this is the first time
     KThread* GetHostDummyThread() {
-        auto make_thread = [this]() {
-            KThread* thread = KThread::Create(system.Kernel());
+        auto initialize = [this](KThread* thread) {
             ASSERT(KThread::InitializeDummyThread(thread).IsSuccess());
             thread->SetName(fmt::format("DummyThread:{}", GetHostThreadId()));
             return thread;
         };
 
-        thread_local KThread* saved_thread = make_thread();
-        return saved_thread;
+        thread_local auto raw_thread = KThread(system.Kernel());
+        thread_local auto thread = initialize(&raw_thread);
+
+        return thread;
     }
 
     /// Registers a CPU core thread by allocating a host thread ID for it
@@ -660,22 +651,6 @@ struct KernelCore::Impl {
                                     time_phys_addr, time_size, "Time:SharedMemory");
     }
 
-    void InitializePageSlab() {
-        // Allocate slab heaps
-        user_slab_heap_pages =
-            std::make_unique<KSlabHeap<Page>>(KSlabHeap<Page>::AllocationType::Guest);
-
-        // TODO(ameerj): This should be derived, not hardcoded within the kernel
-        constexpr u64 user_slab_heap_size{0x3de000};
-        // Reserve slab heaps
-        ASSERT(
-            system_resource_limit->Reserve(LimitableResource::PhysicalMemory, user_slab_heap_size));
-        // Initialize slab heap
-        user_slab_heap_pages->Initialize(
-            system.DeviceMemory().GetPointer(Core::DramMemoryMap::SlabHeapBase),
-            user_slab_heap_size);
-    }
-
     KClientPort* CreateNamedServicePort(std::string name) {
         auto search = service_interface_factory.find(name);
         if (search == service_interface_factory.end()) {
@@ -684,13 +659,20 @@ struct KernelCore::Impl {
         }
 
         KClientPort* port = &search->second(system.ServiceManager(), system);
-        {
-            std::lock_guard lk(server_ports_lock);
-            server_ports.insert(&port->GetParent()->GetServerPort());
-        }
+        RegisterServerObject(&port->GetParent()->GetServerPort());
         return port;
     }
 
+    void RegisterServerObject(KAutoObject* server_object) {
+        std::scoped_lock lk(server_objects_lock);
+        server_objects.insert(server_object);
+    }
+
+    void UnregisterServerObject(KAutoObject* server_object) {
+        std::scoped_lock lk(server_objects_lock);
+        server_objects.erase(server_object);
+    }
+
     std::weak_ptr<Kernel::ServiceThread> CreateServiceThread(KernelCore& kernel,
                                                              const std::string& name) {
         auto service_thread = std::make_shared<Kernel::ServiceThread>(kernel, 1, name);
@@ -703,6 +685,12 @@ struct KernelCore::Impl {
 
     void ReleaseServiceThread(std::weak_ptr<Kernel::ServiceThread> service_thread) {
         if (auto strong_ptr = service_thread.lock()) {
+            if (strong_ptr == default_service_thread.lock()) {
+                // Nothing to do here, the service is using default_service_thread, which will be
+                // released on shutdown.
+                return;
+            }
+
             service_threads_manager.QueueWork(
                 [this, strong_ptr{std::move(strong_ptr)}]() { service_threads.erase(strong_ptr); });
         }
@@ -712,8 +700,7 @@ struct KernelCore::Impl {
         service_threads_manager.QueueWork([this]() { service_threads.clear(); });
     }
 
-    std::mutex server_ports_lock;
-    std::mutex server_sessions_lock;
+    std::mutex server_objects_lock;
     std::mutex registered_objects_lock;
     std::mutex registered_in_use_objects_lock;
 
@@ -724,7 +711,7 @@ struct KernelCore::Impl {
 
     // Lists all processes that exist in the current session.
     std::vector<KProcess*> process_list;
-    KProcess* current_process{};
+    std::atomic<KProcess*> current_process{};
     std::unique_ptr<Kernel::GlobalSchedulerContext> global_scheduler_context;
     Kernel::TimeManager time_manager;
 
@@ -737,14 +724,13 @@ struct KernelCore::Impl {
     // stores all the objects in place.
     std::unique_ptr<KHandleTable> global_handle_table;
 
-    KAutoObjectWithListContainer object_list_container;
+    std::unique_ptr<KAutoObjectWithListContainer> global_object_list_container;
 
     /// Map of named ports managed by the kernel, which can be retrieved using
     /// the ConnectToPort SVC.
     std::unordered_map<std::string, ServiceInterfaceFactory> service_interface_factory;
     NamedPortTable named_ports;
-    std::unordered_set<KServerPort*> server_ports;
-    std::unordered_set<KServerSession*> server_sessions;
+    std::unordered_set<KAutoObject*> server_objects;
     std::unordered_set<KAutoObject*> registered_objects;
     std::unordered_set<KAutoObject*> registered_in_use_objects;
 
@@ -756,7 +742,6 @@ struct KernelCore::Impl {
 
     // Kernel memory management
     std::unique_ptr<KMemoryManager> memory_manager;
-    std::unique_ptr<KSlabHeap<Page>> user_slab_heap_pages;
 
     // Shared memory for services
     Kernel::KSharedMemory* hid_shared_mem{};
@@ -768,7 +753,8 @@ struct KernelCore::Impl {
     std::unique_ptr<KMemoryLayout> memory_layout;
 
     // Threads used for services
-    std::unordered_set<std::shared_ptr<Kernel::ServiceThread>> service_threads;
+    std::unordered_set<std::shared_ptr<ServiceThread>> service_threads;
+    std::weak_ptr<ServiceThread> default_service_thread;
     Common::ThreadWorker service_threads_manager;
 
     std::array<KThread*, Core::Hardware::NUM_CPU_CORES> suspend_threads;
@@ -915,11 +901,11 @@ const Core::ExclusiveMonitor& KernelCore::GetExclusiveMonitor() const {
 }
 
 KAutoObjectWithListContainer& KernelCore::ObjectListContainer() {
-    return impl->object_list_container;
+    return *impl->global_object_list_container;
 }
 
 const KAutoObjectWithListContainer& KernelCore::ObjectListContainer() const {
-    return impl->object_list_container;
+    return *impl->global_object_list_container;
 }
 
 void KernelCore::InvalidateAllInstructionCaches() {
@@ -949,33 +935,31 @@ KClientPort* KernelCore::CreateNamedServicePort(std::string name) {
     return impl->CreateNamedServicePort(std::move(name));
 }
 
-void KernelCore::RegisterServerSession(KServerSession* server_session) {
-    std::lock_guard lk(impl->server_sessions_lock);
-    impl->server_sessions.insert(server_session);
+void KernelCore::RegisterServerObject(KAutoObject* server_object) {
+    impl->RegisterServerObject(server_object);
 }
 
-void KernelCore::UnregisterServerSession(KServerSession* server_session) {
-    std::lock_guard lk(impl->server_sessions_lock);
-    impl->server_sessions.erase(server_session);
+void KernelCore::UnregisterServerObject(KAutoObject* server_object) {
+    impl->UnregisterServerObject(server_object);
 }
 
 void KernelCore::RegisterKernelObject(KAutoObject* object) {
-    std::lock_guard lk(impl->registered_objects_lock);
+    std::scoped_lock lk{impl->registered_objects_lock};
     impl->registered_objects.insert(object);
 }
 
 void KernelCore::UnregisterKernelObject(KAutoObject* object) {
-    std::lock_guard lk(impl->registered_objects_lock);
+    std::scoped_lock lk{impl->registered_objects_lock};
     impl->registered_objects.erase(object);
 }
 
 void KernelCore::RegisterInUseObject(KAutoObject* object) {
-    std::lock_guard lk(impl->registered_in_use_objects_lock);
+    std::scoped_lock lk{impl->registered_in_use_objects_lock};
     impl->registered_in_use_objects.insert(object);
 }
 
 void KernelCore::UnregisterInUseObject(KAutoObject* object) {
-    std::lock_guard lk(impl->registered_in_use_objects_lock);
+    std::scoped_lock lk{impl->registered_in_use_objects_lock};
     impl->registered_in_use_objects.erase(object);
 }
 
@@ -1031,14 +1015,6 @@ const KMemoryManager& KernelCore::MemoryManager() const {
     return *impl->memory_manager;
 }
 
-KSlabHeap<Page>& KernelCore::GetUserSlabHeapPages() {
-    return *impl->user_slab_heap_pages;
-}
-
-const KSlabHeap<Page>& KernelCore::GetUserSlabHeapPages() const {
-    return *impl->user_slab_heap_pages;
-}
-
 Kernel::KSharedMemory& KernelCore::GetHidSharedMem() {
     return *impl->hid_shared_mem;
 }
@@ -1112,6 +1088,10 @@ std::weak_ptr<Kernel::ServiceThread> KernelCore::CreateServiceThread(const std::
     return impl->CreateServiceThread(*this, name);
 }
 
+std::weak_ptr<Kernel::ServiceThread> KernelCore::GetDefaultServiceThread() const {
+    return impl->default_service_thread;
+}
+
 void KernelCore::ReleaseServiceThread(std::weak_ptr<Kernel::ServiceThread> service_thread) {
     impl->ReleaseServiceThread(service_thread);
 }
diff --git a/src/core/hle/kernel/kernel.h b/src/core/hle/kernel/kernel.h
index c1254b18d..d709c368b 100644
--- a/src/core/hle/kernel/kernel.h
+++ b/src/core/hle/kernel/kernel.h
@@ -14,7 +14,6 @@
 #include "core/hardware_properties.h"
 #include "core/hle/kernel/k_auto_object.h"
 #include "core/hle/kernel/k_slab_heap.h"
-#include "core/hle/kernel/memory_types.h"
 #include "core/hle/kernel/svc_common.h"
 
 namespace Core {
@@ -43,6 +42,7 @@ class KHandleTable;
 class KLinkedListNode;
 class KMemoryLayout;
 class KMemoryManager;
+class KPageBuffer;
 class KPort;
 class KProcess;
 class KResourceLimit;
@@ -52,6 +52,7 @@ class KSession;
 class KSharedMemory;
 class KSharedMemoryInfo;
 class KThread;
+class KThreadLocalPage;
 class KTransferMemory;
 class KWorkerTaskManager;
 class KWritableEvent;
@@ -194,13 +195,13 @@ public:
     /// Opens a port to a service previously registered with RegisterNamedService.
     KClientPort* CreateNamedServicePort(std::string name);
 
-    /// Registers a server session with the gobal emulation state, to be freed on shutdown. This is
-    /// necessary because we do not emulate processes for HLE sessions.
-    void RegisterServerSession(KServerSession* server_session);
+    /// Registers a server session or port with the gobal emulation state, to be freed on shutdown.
+    /// This is necessary because we do not emulate processes for HLE sessions and ports.
+    void RegisterServerObject(KAutoObject* server_object);
 
-    /// Unregisters a server session previously registered with RegisterServerSession when it was
-    /// destroyed during the current emulation session.
-    void UnregisterServerSession(KServerSession* server_session);
+    /// Unregisters a server session or port previously registered with RegisterServerSession when
+    /// it was destroyed during the current emulation session.
+    void UnregisterServerObject(KAutoObject* server_object);
 
     /// Registers all kernel objects with the global emulation state, this is purely for tracking
     /// leaks after emulation has been shutdown.
@@ -239,12 +240,6 @@ public:
     /// Gets the virtual memory manager for the kernel.
     const KMemoryManager& MemoryManager() const;
 
-    /// Gets the slab heap allocated for user space pages.
-    KSlabHeap<Page>& GetUserSlabHeapPages();
-
-    /// Gets the slab heap allocated for user space pages.
-    const KSlabHeap<Page>& GetUserSlabHeapPages() const;
-
     /// Gets the shared memory object for HID services.
     Kernel::KSharedMemory& GetHidSharedMem();
 
@@ -284,9 +279,11 @@ public:
     void ExitSVCProfile();
 
     /**
-     * Creates an HLE service thread, which are used to execute service routines asynchronously.
-     * While these are allocated per ServerSession, these need to be owned and managed outside
-     * of ServerSession to avoid a circular dependency.
+     * Creates a host thread to execute HLE service requests, which are used to execute service
+     * routines asynchronously. While these are allocated per ServerSession, these need to be owned
+     * and managed outside of ServerSession to avoid a circular dependency. In general, most
+     * services can just use the default service thread, and not need their own host service thread.
+     * See GetDefaultServiceThread.
      * @param name String name for the ServerSession creating this thread, used for debug
      * purposes.
      * @returns The a weak pointer newly created service thread.
@@ -294,6 +291,14 @@ public:
     std::weak_ptr<Kernel::ServiceThread> CreateServiceThread(const std::string& name);
 
     /**
+     * Gets the default host service thread, which executes HLE service requests. Unless service
+     * requests need to block on the host, the default service thread should be used in favor of
+     * creating a new service thread.
+     * @returns The a weak pointer for the default service thread.
+     */
+    std::weak_ptr<Kernel::ServiceThread> GetDefaultServiceThread() const;
+
+    /**
      * Releases a HLE service thread, instructing KernelCore to free it. This should be called when
      * the ServerSession associated with the thread is destroyed.
      * @param service_thread Service thread to release.
@@ -336,6 +341,10 @@ public:
             return slab_heap_container->writeable_event;
         } else if constexpr (std::is_same_v<T, KCodeMemory>) {
             return slab_heap_container->code_memory;
+        } else if constexpr (std::is_same_v<T, KPageBuffer>) {
+            return slab_heap_container->page_buffer;
+        } else if constexpr (std::is_same_v<T, KThreadLocalPage>) {
+            return slab_heap_container->thread_local_page;
         }
     }
 
@@ -397,6 +406,8 @@ private:
         KSlabHeap<KTransferMemory> transfer_memory;
         KSlabHeap<KWritableEvent> writeable_event;
         KSlabHeap<KCodeMemory> code_memory;
+        KSlabHeap<KPageBuffer> page_buffer;
+        KSlabHeap<KThreadLocalPage> thread_local_page;
     };
 
     std::unique_ptr<SlabHeapContainer> slab_heap_container;
diff --git a/src/core/hle/kernel/physical_core.cpp b/src/core/hle/kernel/physical_core.cpp
index 7477668e4..18a5f40f8 100644
--- a/src/core/hle/kernel/physical_core.cpp
+++ b/src/core/hle/kernel/physical_core.cpp
@@ -58,6 +58,7 @@ bool PhysicalCore::IsInterrupted() const {
 void PhysicalCore::Interrupt() {
     guard->lock();
     interrupts[core_index].SetInterrupt(true);
+    arm_interface->SignalInterrupt();
     guard->unlock();
 }
 
diff --git a/src/core/hle/kernel/service_thread.cpp b/src/core/hle/kernel/service_thread.cpp
index 4eb3a5988..52d25b837 100644
--- a/src/core/hle/kernel/service_thread.cpp
+++ b/src/core/hle/kernel/service_thread.cpp
@@ -49,12 +49,9 @@ ServiceThread::Impl::Impl(KernelCore& kernel, std::size_t num_threads, const std
                 return;
             }
 
+            // Allocate a dummy guest thread for this host thread.
             kernel.RegisterHostThread();
 
-            // Ensure the dummy thread allocated for this host thread is closed on exit.
-            auto* dummy_thread = kernel.GetCurrentEmuThread();
-            SCOPE_EXIT({ dummy_thread->Close(); });
-
             while (true) {
                 std::function<void()> task;
 
diff --git a/src/core/hle/kernel/slab_helpers.h b/src/core/hle/kernel/slab_helpers.h
index f1c11256e..dc1e48fc9 100644
--- a/src/core/hle/kernel/slab_helpers.h
+++ b/src/core/hle/kernel/slab_helpers.h
@@ -59,7 +59,7 @@ class KAutoObjectWithSlabHeapAndContainer : public Base {
 
 private:
     static Derived* Allocate(KernelCore& kernel) {
-        return kernel.SlabHeap<Derived>().AllocateWithKernel(kernel);
+        return kernel.SlabHeap<Derived>().Allocate(kernel);
     }
 
     static void Free(KernelCore& kernel, Derived* obj) {
diff --git a/src/core/hle/kernel/svc.cpp b/src/core/hle/kernel/svc.cpp
index 839171e85..0c86435b5 100644
--- a/src/core/hle/kernel/svc.cpp
+++ b/src/core/hle/kernel/svc.cpp
@@ -1362,8 +1362,11 @@ static ResultCode MapProcessMemory(Core::System& system, VAddr dst_address, Hand
              ResultInvalidMemoryRegion);
 
     // Create a new page group.
-    KMemoryInfo kBlockInfo = dst_pt.QueryInfo(dst_address);
-    KPageLinkedList pg(kBlockInfo.GetAddress(), kBlockInfo.GetNumPages());
+    KPageLinkedList pg;
+    R_TRY(src_pt.MakeAndOpenPageGroup(
+        std::addressof(pg), src_address, size / PageSize, KMemoryState::FlagCanMapProcess,
+        KMemoryState::FlagCanMapProcess, KMemoryPermission::None, KMemoryPermission::None,
+        KMemoryAttribute::All, KMemoryAttribute::None));
 
     // Map the group.
     R_TRY(dst_pt.MapPages(dst_address, pg, KMemoryState::SharedCode,
@@ -1408,8 +1411,8 @@ static ResultCode UnmapProcessMemory(Core::System& system, VAddr dst_address, Ha
 }
 
 static ResultCode CreateCodeMemory(Core::System& system, Handle* out, VAddr address, size_t size) {
-    LOG_TRACE(Kernel_SVC, "called, handle_out={}, address=0x{:X}, size=0x{:X}",
-              static_cast<void*>(out), address, size);
+    LOG_TRACE(Kernel_SVC, "called, address=0x{:X}, size=0x{:X}", address, size);
+
     // Get kernel instance.
     auto& kernel = system.Kernel();
 
@@ -1664,7 +1667,7 @@ static ResultCode UnmapProcessCodeMemory(Core::System& system, Handle process_ha
         return ResultInvalidAddress;
     }
 
-    if (size == 0 || Common::Is4KBAligned(size)) {
+    if (size == 0 || !Common::Is4KBAligned(size)) {
         LOG_ERROR(Kernel_SVC, "Size is zero or not page-aligned (size=0x{:016X}).", size);
         return ResultInvalidSize;
     }
@@ -1710,7 +1713,8 @@ static ResultCode UnmapProcessCodeMemory(Core::System& system, Handle process_ha
         return ResultInvalidMemoryRegion;
     }
 
-    return page_table.UnmapCodeMemory(dst_address, src_address, size);
+    return page_table.UnmapCodeMemory(dst_address, src_address, size,
+                                      KPageTable::ICacheInvalidationStrategy::InvalidateAll);
 }
 
 /// Exits the current process
diff --git a/src/core/hle/kernel/svc_types.h b/src/core/hle/kernel/svc_types.h
index 365e22e4e..b2e9ec092 100644
--- a/src/core/hle/kernel/svc_types.h
+++ b/src/core/hle/kernel/svc_types.h
@@ -96,4 +96,6 @@ constexpr inline s32 IdealCoreNoUpdate = -3;
 constexpr inline s32 LowestThreadPriority = 63;
 constexpr inline s32 HighestThreadPriority = 0;
 
+constexpr inline size_t ThreadLocalRegionSize = 0x200;
+
 } // namespace Kernel::Svc
diff --git a/src/core/hle/kernel/time_manager.cpp b/src/core/hle/kernel/time_manager.cpp
index aa985d820..5b8fe8eae 100644
--- a/src/core/hle/kernel/time_manager.cpp
+++ b/src/core/hle/kernel/time_manager.cpp
@@ -24,7 +24,7 @@ TimeManager::TimeManager(Core::System& system_) : system{system_} {
 }
 
 void TimeManager::ScheduleTimeEvent(KThread* thread, s64 nanoseconds) {
-    std::lock_guard lock{mutex};
+    std::scoped_lock lock{mutex};
     if (nanoseconds > 0) {
         ASSERT(thread);
         ASSERT(thread->GetState() != ThreadState::Runnable);
@@ -35,7 +35,7 @@ void TimeManager::ScheduleTimeEvent(KThread* thread, s64 nanoseconds) {
 }
 
 void TimeManager::UnscheduleTimeEvent(KThread* thread) {
-    std::lock_guard lock{mutex};
+    std::scoped_lock lock{mutex};
     system.CoreTiming().UnscheduleEvent(time_manager_event_type,
                                         reinterpret_cast<uintptr_t>(thread));
 }
diff --git a/src/core/hle/service/acc/acc.cpp b/src/core/hle/service/acc/acc.cpp
index e34ef5a78..8a5332991 100644
--- a/src/core/hle/service/acc/acc.cpp
+++ b/src/core/hle/service/acc/acc.cpp
@@ -16,7 +16,6 @@
 #include "core/file_sys/control_metadata.h"
 #include "core/file_sys/patch_manager.h"
 #include "core/hle/ipc_helpers.h"
-#include "core/hle/kernel/kernel.h"
 #include "core/hle/service/acc/acc.h"
 #include "core/hle/service/acc/acc_aa.h"
 #include "core/hle/service/acc/acc_su.h"
diff --git a/src/core/hle/service/acc/profile_manager.h b/src/core/hle/service/acc/profile_manager.h
index 17347f7ef..5b690b406 100644
--- a/src/core/hle/service/acc/profile_manager.h
+++ b/src/core/hle/service/acc/profile_manager.h
@@ -7,6 +7,7 @@
 #include <array>
 #include <optional>
 
+#include "common/common_funcs.h"
 #include "common/common_types.h"
 #include "common/swap.h"
 #include "common/uuid.h"
diff --git a/src/core/hle/service/am/am.cpp b/src/core/hle/service/am/am.cpp
index 2f8e21568..4d7e5ecd3 100644
--- a/src/core/hle/service/am/am.cpp
+++ b/src/core/hle/service/am/am.cpp
@@ -980,7 +980,7 @@ private:
         LOG_DEBUG(Service_AM, "called");
 
         IPC::RequestParser rp{ctx};
-        applet->GetBroker().PushNormalDataFromGame(rp.PopIpcInterface<IStorage>());
+        applet->GetBroker().PushNormalDataFromGame(rp.PopIpcInterface<IStorage>().lock());
 
         IPC::ResponseBuilder rb{ctx, 2};
         rb.Push(ResultSuccess);
@@ -1007,7 +1007,7 @@ private:
         LOG_DEBUG(Service_AM, "called");
 
         IPC::RequestParser rp{ctx};
-        applet->GetBroker().PushInteractiveDataFromGame(rp.PopIpcInterface<IStorage>());
+        applet->GetBroker().PushInteractiveDataFromGame(rp.PopIpcInterface<IStorage>().lock());
 
         ASSERT(applet->IsInitialized());
         applet->ExecuteInteractive();
@@ -1337,7 +1337,7 @@ IApplicationFunctions::IApplicationFunctions(Core::System& system_)
         {200, nullptr, "GetLastApplicationExitReason"},
         {500, nullptr, "StartContinuousRecordingFlushForDebug"},
         {1000, nullptr, "CreateMovieMaker"},
-        {1001, nullptr, "PrepareForJit"},
+        {1001, &IApplicationFunctions::PrepareForJit, "PrepareForJit"},
     };
     // clang-format on
 
@@ -1787,6 +1787,13 @@ void IApplicationFunctions::GetHealthWarningDisappearedSystemEvent(Kernel::HLERe
     rb.PushCopyObjects(health_warning_disappeared_system_event->GetReadableEvent());
 }
 
+void IApplicationFunctions::PrepareForJit(Kernel::HLERequestContext& ctx) {
+    LOG_WARNING(Service_AM, "(STUBBED) called");
+
+    IPC::ResponseBuilder rb{ctx, 2};
+    rb.Push(ResultSuccess);
+}
+
 void InstallInterfaces(SM::ServiceManager& service_manager, NVFlinger::NVFlinger& nvflinger,
                        Core::System& system) {
     auto message_queue = std::make_shared<AppletMessageQueue>(system);
diff --git a/src/core/hle/service/am/am.h b/src/core/hle/service/am/am.h
index fdd937b82..11a3c0459 100644
--- a/src/core/hle/service/am/am.h
+++ b/src/core/hle/service/am/am.h
@@ -336,6 +336,7 @@ private:
     void TryPopFromFriendInvitationStorageChannel(Kernel::HLERequestContext& ctx);
     void GetNotificationStorageChannelEvent(Kernel::HLERequestContext& ctx);
     void GetHealthWarningDisappearedSystemEvent(Kernel::HLERequestContext& ctx);
+    void PrepareForJit(Kernel::HLERequestContext& ctx);
 
     KernelHelpers::ServiceContext service_context;
 
diff --git a/src/core/hle/service/am/applets/applet_mii_edit.cpp b/src/core/hle/service/am/applets/applet_mii_edit.cpp
new file mode 100644
index 000000000..8fbde1be4
--- /dev/null
+++ b/src/core/hle/service/am/applets/applet_mii_edit.cpp
@@ -0,0 +1,139 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#include "common/assert.h"
+#include "common/logging/log.h"
+#include "core/core.h"
+#include "core/frontend/applets/mii_edit.h"
+#include "core/hle/service/am/am.h"
+#include "core/hle/service/am/applets/applet_mii_edit.h"
+#include "core/hle/service/mii/mii_manager.h"
+
+namespace Service::AM::Applets {
+
+MiiEdit::MiiEdit(Core::System& system_, LibraryAppletMode applet_mode_,
+                 const Core::Frontend::MiiEditApplet& frontend_)
+    : Applet{system_, applet_mode_}, frontend{frontend_}, system{system_} {}
+
+MiiEdit::~MiiEdit() = default;
+
+void MiiEdit::Initialize() {
+    // Note: MiiEdit is not initialized with common arguments.
+    //       Instead, it is initialized by an AppletInput storage with size 0x100 bytes.
+    //       Do NOT call Applet::Initialize() here.
+
+    const auto storage = broker.PopNormalDataToApplet();
+    ASSERT(storage != nullptr);
+
+    const auto applet_input_data = storage->GetData();
+    ASSERT(applet_input_data.size() >= sizeof(MiiEditAppletInputCommon));
+
+    std::memcpy(&applet_input_common, applet_input_data.data(), sizeof(MiiEditAppletInputCommon));
+
+    LOG_INFO(Service_AM,
+             "Initializing MiiEdit Applet with MiiEditAppletVersion={} and MiiEditAppletMode={}",
+             applet_input_common.version, applet_input_common.applet_mode);
+
+    switch (applet_input_common.version) {
+    case MiiEditAppletVersion::Version3:
+        ASSERT(applet_input_data.size() ==
+               sizeof(MiiEditAppletInputCommon) + sizeof(MiiEditAppletInputV3));
+        std::memcpy(&applet_input_v3, applet_input_data.data() + sizeof(MiiEditAppletInputCommon),
+                    sizeof(MiiEditAppletInputV3));
+        break;
+    case MiiEditAppletVersion::Version4:
+        ASSERT(applet_input_data.size() ==
+               sizeof(MiiEditAppletInputCommon) + sizeof(MiiEditAppletInputV4));
+        std::memcpy(&applet_input_v4, applet_input_data.data() + sizeof(MiiEditAppletInputCommon),
+                    sizeof(MiiEditAppletInputV4));
+        break;
+    default:
+        UNIMPLEMENTED_MSG("Unknown MiiEditAppletVersion={} with size={}",
+                          applet_input_common.version, applet_input_data.size());
+        ASSERT(applet_input_data.size() >=
+               sizeof(MiiEditAppletInputCommon) + sizeof(MiiEditAppletInputV4));
+        std::memcpy(&applet_input_v4, applet_input_data.data() + sizeof(MiiEditAppletInputCommon),
+                    sizeof(MiiEditAppletInputV4));
+        break;
+    }
+}
+
+bool MiiEdit::TransactionComplete() const {
+    return is_complete;
+}
+
+ResultCode MiiEdit::GetStatus() const {
+    return ResultSuccess;
+}
+
+void MiiEdit::ExecuteInteractive() {
+    UNREACHABLE_MSG("Attempted to call interactive execution on non-interactive applet.");
+}
+
+void MiiEdit::Execute() {
+    if (is_complete) {
+        return;
+    }
+
+    // This is a default stub for each of the MiiEdit applet modes.
+    switch (applet_input_common.applet_mode) {
+    case MiiEditAppletMode::ShowMiiEdit:
+    case MiiEditAppletMode::AppendMii:
+    case MiiEditAppletMode::AppendMiiImage:
+    case MiiEditAppletMode::UpdateMiiImage:
+        MiiEditOutput(MiiEditResult::Success, 0);
+        break;
+    case MiiEditAppletMode::CreateMii:
+    case MiiEditAppletMode::EditMii: {
+        Service::Mii::MiiManager mii_manager;
+
+        const MiiEditCharInfo char_info{
+            .mii_info{applet_input_common.applet_mode == MiiEditAppletMode::EditMii
+                          ? applet_input_v4.char_info.mii_info
+                          : mii_manager.BuildDefault(0)},
+        };
+
+        MiiEditOutputForCharInfoEditing(MiiEditResult::Success, char_info);
+        break;
+    }
+    default:
+        UNIMPLEMENTED_MSG("Unknown MiiEditAppletMode={}", applet_input_common.applet_mode);
+
+        MiiEditOutput(MiiEditResult::Success, 0);
+        break;
+    }
+}
+
+void MiiEdit::MiiEditOutput(MiiEditResult result, s32 index) {
+    const MiiEditAppletOutput applet_output{
+        .result{result},
+        .index{index},
+    };
+
+    std::vector<u8> out_data(sizeof(MiiEditAppletOutput));
+    std::memcpy(out_data.data(), &applet_output, sizeof(MiiEditAppletOutput));
+
+    is_complete = true;
+
+    broker.PushNormalDataFromApplet(std::make_shared<IStorage>(system, std::move(out_data)));
+    broker.SignalStateChanged();
+}
+
+void MiiEdit::MiiEditOutputForCharInfoEditing(MiiEditResult result,
+                                              const MiiEditCharInfo& char_info) {
+    const MiiEditAppletOutputForCharInfoEditing applet_output{
+        .result{result},
+        .char_info{char_info},
+    };
+
+    std::vector<u8> out_data(sizeof(MiiEditAppletOutputForCharInfoEditing));
+    std::memcpy(out_data.data(), &applet_output, sizeof(MiiEditAppletOutputForCharInfoEditing));
+
+    is_complete = true;
+
+    broker.PushNormalDataFromApplet(std::make_shared<IStorage>(system, std::move(out_data)));
+    broker.SignalStateChanged();
+}
+
+} // namespace Service::AM::Applets
diff --git a/src/core/hle/service/am/applets/applet_mii_edit.h b/src/core/hle/service/am/applets/applet_mii_edit.h
new file mode 100644
index 000000000..e9ca0e2af
--- /dev/null
+++ b/src/core/hle/service/am/applets/applet_mii_edit.h
@@ -0,0 +1,45 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#pragma once
+
+#include "core/hle/result.h"
+#include "core/hle/service/am/applets/applet_mii_edit_types.h"
+#include "core/hle/service/am/applets/applets.h"
+
+namespace Core {
+class System;
+} // namespace Core
+
+namespace Service::AM::Applets {
+
+class MiiEdit final : public Applet {
+public:
+    explicit MiiEdit(Core::System& system_, LibraryAppletMode applet_mode_,
+                     const Core::Frontend::MiiEditApplet& frontend_);
+    ~MiiEdit() override;
+
+    void Initialize() override;
+
+    bool TransactionComplete() const override;
+    ResultCode GetStatus() const override;
+    void ExecuteInteractive() override;
+    void Execute() override;
+
+    void MiiEditOutput(MiiEditResult result, s32 index);
+
+    void MiiEditOutputForCharInfoEditing(MiiEditResult result, const MiiEditCharInfo& char_info);
+
+private:
+    const Core::Frontend::MiiEditApplet& frontend;
+    Core::System& system;
+
+    MiiEditAppletInputCommon applet_input_common{};
+    MiiEditAppletInputV3 applet_input_v3{};
+    MiiEditAppletInputV4 applet_input_v4{};
+
+    bool is_complete{false};
+};
+
+} // namespace Service::AM::Applets
diff --git a/src/core/hle/service/am/applets/applet_mii_edit_types.h b/src/core/hle/service/am/applets/applet_mii_edit_types.h
new file mode 100644
index 000000000..70dea0007
--- /dev/null
+++ b/src/core/hle/service/am/applets/applet_mii_edit_types.h
@@ -0,0 +1,83 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#pragma once
+
+#include <array>
+
+#include "common/common_funcs.h"
+#include "common/common_types.h"
+#include "core/hle/service/mii/types.h"
+
+namespace Service::AM::Applets {
+
+enum class MiiEditAppletVersion : s32 {
+    Version3 = 0x3, // 1.0.0 - 10.1.1
+    Version4 = 0x4, // 10.2.0+
+};
+
+// This is nn::mii::AppletMode
+enum class MiiEditAppletMode : u32 {
+    ShowMiiEdit = 0,
+    AppendMii = 1,
+    AppendMiiImage = 2,
+    UpdateMiiImage = 3,
+    CreateMii = 4,
+    EditMii = 5,
+};
+
+enum class MiiEditResult : u32 {
+    Success,
+    Cancel,
+};
+
+struct MiiEditCharInfo {
+    Service::Mii::MiiInfo mii_info{};
+};
+static_assert(sizeof(MiiEditCharInfo) == 0x58, "MiiEditCharInfo has incorrect size.");
+
+struct MiiEditAppletInputCommon {
+    MiiEditAppletVersion version{};
+    MiiEditAppletMode applet_mode{};
+};
+static_assert(sizeof(MiiEditAppletInputCommon) == 0x8,
+              "MiiEditAppletInputCommon has incorrect size.");
+
+struct MiiEditAppletInputV3 {
+    u32 special_mii_key_code{};
+    std::array<Common::UUID, 8> valid_uuids{};
+    Common::UUID used_uuid{};
+    INSERT_PADDING_BYTES(0x64);
+};
+static_assert(sizeof(MiiEditAppletInputV3) == 0x100 - sizeof(MiiEditAppletInputCommon),
+              "MiiEditAppletInputV3 has incorrect size.");
+
+struct MiiEditAppletInputV4 {
+    u32 special_mii_key_code{};
+    MiiEditCharInfo char_info{};
+    INSERT_PADDING_BYTES(0x28);
+    Common::UUID used_uuid{};
+    INSERT_PADDING_BYTES(0x64);
+};
+static_assert(sizeof(MiiEditAppletInputV4) == 0x100 - sizeof(MiiEditAppletInputCommon),
+              "MiiEditAppletInputV4 has incorrect size.");
+
+// This is nn::mii::AppletOutput
+struct MiiEditAppletOutput {
+    MiiEditResult result{};
+    s32 index{};
+    INSERT_PADDING_BYTES(0x18);
+};
+static_assert(sizeof(MiiEditAppletOutput) == 0x20, "MiiEditAppletOutput has incorrect size.");
+
+// This is nn::mii::AppletOutputForCharInfoEditing
+struct MiiEditAppletOutputForCharInfoEditing {
+    MiiEditResult result{};
+    MiiEditCharInfo char_info{};
+    INSERT_PADDING_BYTES(0x24);
+};
+static_assert(sizeof(MiiEditAppletOutputForCharInfoEditing) == 0x80,
+              "MiiEditAppletOutputForCharInfoEditing has incorrect size.");
+
+} // namespace Service::AM::Applets
diff --git a/src/core/hle/service/am/applets/applet_software_keyboard.cpp b/src/core/hle/service/am/applets/applet_software_keyboard.cpp
index f38f53f69..ee669686c 100644
--- a/src/core/hle/service/am/applets/applet_software_keyboard.cpp
+++ b/src/core/hle/service/am/applets/applet_software_keyboard.cpp
@@ -226,7 +226,7 @@ void SoftwareKeyboard::InitializeForeground() {
     ASSERT(work_buffer_storage != nullptr);
 
     if (swkbd_config_common.initial_string_length == 0) {
-        InitializeFrontendKeyboard();
+        InitializeFrontendNormalKeyboard();
         return;
     }
 
@@ -243,7 +243,7 @@ void SoftwareKeyboard::InitializeForeground() {
 
     LOG_DEBUG(Service_AM, "\nInitial Text: {}", Common::UTF16ToUTF8(initial_text));
 
-    InitializeFrontendKeyboard();
+    InitializeFrontendNormalKeyboard();
 }
 
 void SoftwareKeyboard::InitializeBackground(LibraryAppletMode library_applet_mode) {
@@ -480,129 +480,173 @@ void SoftwareKeyboard::ChangeState(SwkbdState state) {
     ReplyDefault();
 }
 
-void SoftwareKeyboard::InitializeFrontendKeyboard() {
-    if (is_background) {
-        const auto& appear_arg = swkbd_calc_arg.appear_arg;
-
-        std::u16string ok_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
-            appear_arg.ok_text.data(), appear_arg.ok_text.size());
-
-        const u32 max_text_length =
-            appear_arg.max_text_length > 0 && appear_arg.max_text_length <= DEFAULT_MAX_TEXT_LENGTH
-                ? appear_arg.max_text_length
-                : DEFAULT_MAX_TEXT_LENGTH;
-
-        const u32 min_text_length =
-            appear_arg.min_text_length <= max_text_length ? appear_arg.min_text_length : 0;
-
-        const s32 initial_cursor_position =
-            current_cursor_position > 0 ? current_cursor_position : 0;
-
-        const auto text_draw_type =
-            max_text_length <= 32 ? SwkbdTextDrawType::Line : SwkbdTextDrawType::Box;
-
-        Core::Frontend::KeyboardInitializeParameters initialize_parameters{
-            .ok_text{std::move(ok_text)},
-            .header_text{},
-            .sub_text{},
-            .guide_text{},
-            .initial_text{current_text},
-            .max_text_length{max_text_length},
-            .min_text_length{min_text_length},
-            .initial_cursor_position{initial_cursor_position},
-            .type{appear_arg.type},
-            .password_mode{SwkbdPasswordMode::Disabled},
-            .text_draw_type{text_draw_type},
-            .key_disable_flags{appear_arg.key_disable_flags},
-            .use_blur_background{false},
-            .enable_backspace_button{swkbd_calc_arg.enable_backspace_button},
-            .enable_return_button{appear_arg.enable_return_button},
-            .disable_cancel_button{appear_arg.disable_cancel_button},
-        };
-
-        frontend.InitializeKeyboard(
-            true, std::move(initialize_parameters), {},
-            [this](SwkbdReplyType reply_type, std::u16string submitted_text, s32 cursor_position) {
-                SubmitTextInline(reply_type, submitted_text, cursor_position);
-            });
-    } else {
-        std::u16string ok_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
-            swkbd_config_common.ok_text.data(), swkbd_config_common.ok_text.size());
-
-        std::u16string header_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
-            swkbd_config_common.header_text.data(), swkbd_config_common.header_text.size());
-
-        std::u16string sub_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
-            swkbd_config_common.sub_text.data(), swkbd_config_common.sub_text.size());
-
-        std::u16string guide_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
-            swkbd_config_common.guide_text.data(), swkbd_config_common.guide_text.size());
-
-        const u32 max_text_length =
-            swkbd_config_common.max_text_length > 0 &&
-                    swkbd_config_common.max_text_length <= DEFAULT_MAX_TEXT_LENGTH
-                ? swkbd_config_common.max_text_length
-                : DEFAULT_MAX_TEXT_LENGTH;
-
-        const u32 min_text_length = swkbd_config_common.min_text_length <= max_text_length
-                                        ? swkbd_config_common.min_text_length
-                                        : 0;
-
-        const s32 initial_cursor_position = [this] {
-            switch (swkbd_config_common.initial_cursor_position) {
-            case SwkbdInitialCursorPosition::Start:
-            default:
-                return 0;
-            case SwkbdInitialCursorPosition::End:
-                return static_cast<s32>(initial_text.size());
-            }
-        }();
-
-        const auto text_draw_type = [this, max_text_length] {
-            switch (swkbd_config_common.text_draw_type) {
-            case SwkbdTextDrawType::Line:
-            default:
-                return max_text_length <= 32 ? SwkbdTextDrawType::Line : SwkbdTextDrawType::Box;
-            case SwkbdTextDrawType::Box:
-            case SwkbdTextDrawType::DownloadCode:
-                return swkbd_config_common.text_draw_type;
-            }
-        }();
-
-        const auto enable_return_button = text_draw_type == SwkbdTextDrawType::Box
-                                              ? swkbd_config_common.enable_return_button
-                                              : false;
-
-        const auto disable_cancel_button = swkbd_applet_version >= SwkbdAppletVersion::Version393227
-                                               ? swkbd_config_new.disable_cancel_button
-                                               : false;
-
-        Core::Frontend::KeyboardInitializeParameters initialize_parameters{
-            .ok_text{std::move(ok_text)},
-            .header_text{std::move(header_text)},
-            .sub_text{std::move(sub_text)},
-            .guide_text{std::move(guide_text)},
-            .initial_text{initial_text},
-            .max_text_length{max_text_length},
-            .min_text_length{min_text_length},
-            .initial_cursor_position{initial_cursor_position},
-            .type{swkbd_config_common.type},
-            .password_mode{swkbd_config_common.password_mode},
-            .text_draw_type{text_draw_type},
-            .key_disable_flags{swkbd_config_common.key_disable_flags},
-            .use_blur_background{swkbd_config_common.use_blur_background},
-            .enable_backspace_button{true},
-            .enable_return_button{enable_return_button},
-            .disable_cancel_button{disable_cancel_button},
-        };
-
-        frontend.InitializeKeyboard(
-            false, std::move(initialize_parameters),
-            [this](SwkbdResult result, std::u16string submitted_text, bool confirmed) {
-                SubmitTextNormal(result, submitted_text, confirmed);
-            },
-            {});
-    }
+void SoftwareKeyboard::InitializeFrontendNormalKeyboard() {
+    std::u16string ok_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
+        swkbd_config_common.ok_text.data(), swkbd_config_common.ok_text.size());
+
+    std::u16string header_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
+        swkbd_config_common.header_text.data(), swkbd_config_common.header_text.size());
+
+    std::u16string sub_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
+        swkbd_config_common.sub_text.data(), swkbd_config_common.sub_text.size());
+
+    std::u16string guide_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
+        swkbd_config_common.guide_text.data(), swkbd_config_common.guide_text.size());
+
+    const u32 max_text_length =
+        swkbd_config_common.max_text_length > 0 &&
+                swkbd_config_common.max_text_length <= DEFAULT_MAX_TEXT_LENGTH
+            ? swkbd_config_common.max_text_length
+            : DEFAULT_MAX_TEXT_LENGTH;
+
+    const u32 min_text_length = swkbd_config_common.min_text_length <= max_text_length
+                                    ? swkbd_config_common.min_text_length
+                                    : 0;
+
+    const s32 initial_cursor_position = [this] {
+        switch (swkbd_config_common.initial_cursor_position) {
+        case SwkbdInitialCursorPosition::Start:
+        default:
+            return 0;
+        case SwkbdInitialCursorPosition::End:
+            return static_cast<s32>(initial_text.size());
+        }
+    }();
+
+    const auto text_draw_type = [this, max_text_length] {
+        switch (swkbd_config_common.text_draw_type) {
+        case SwkbdTextDrawType::Line:
+        default:
+            return max_text_length <= 32 ? SwkbdTextDrawType::Line : SwkbdTextDrawType::Box;
+        case SwkbdTextDrawType::Box:
+        case SwkbdTextDrawType::DownloadCode:
+            return swkbd_config_common.text_draw_type;
+        }
+    }();
+
+    const auto enable_return_button =
+        text_draw_type == SwkbdTextDrawType::Box ? swkbd_config_common.enable_return_button : false;
+
+    const auto disable_cancel_button = swkbd_applet_version >= SwkbdAppletVersion::Version393227
+                                           ? swkbd_config_new.disable_cancel_button
+                                           : false;
+
+    Core::Frontend::KeyboardInitializeParameters initialize_parameters{
+        .ok_text{std::move(ok_text)},
+        .header_text{std::move(header_text)},
+        .sub_text{std::move(sub_text)},
+        .guide_text{std::move(guide_text)},
+        .initial_text{initial_text},
+        .max_text_length{max_text_length},
+        .min_text_length{min_text_length},
+        .initial_cursor_position{initial_cursor_position},
+        .type{swkbd_config_common.type},
+        .password_mode{swkbd_config_common.password_mode},
+        .text_draw_type{text_draw_type},
+        .key_disable_flags{swkbd_config_common.key_disable_flags},
+        .use_blur_background{swkbd_config_common.use_blur_background},
+        .enable_backspace_button{true},
+        .enable_return_button{enable_return_button},
+        .disable_cancel_button{disable_cancel_button},
+    };
+
+    frontend.InitializeKeyboard(
+        false, std::move(initialize_parameters),
+        [this](SwkbdResult result, std::u16string submitted_text, bool confirmed) {
+            SubmitTextNormal(result, submitted_text, confirmed);
+        },
+        {});
+}
+
+void SoftwareKeyboard::InitializeFrontendInlineKeyboard(
+    Core::Frontend::KeyboardInitializeParameters initialize_parameters) {
+    frontend.InitializeKeyboard(
+        true, std::move(initialize_parameters), {},
+        [this](SwkbdReplyType reply_type, std::u16string submitted_text, s32 cursor_position) {
+            SubmitTextInline(reply_type, submitted_text, cursor_position);
+        });
+}
+
+void SoftwareKeyboard::InitializeFrontendInlineKeyboardOld() {
+    const auto& appear_arg = swkbd_calc_arg_old.appear_arg;
+
+    std::u16string ok_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
+        appear_arg.ok_text.data(), appear_arg.ok_text.size());
+
+    const u32 max_text_length =
+        appear_arg.max_text_length > 0 && appear_arg.max_text_length <= DEFAULT_MAX_TEXT_LENGTH
+            ? appear_arg.max_text_length
+            : DEFAULT_MAX_TEXT_LENGTH;
+
+    const u32 min_text_length =
+        appear_arg.min_text_length <= max_text_length ? appear_arg.min_text_length : 0;
+
+    const s32 initial_cursor_position = current_cursor_position > 0 ? current_cursor_position : 0;
+
+    const auto text_draw_type =
+        max_text_length <= 32 ? SwkbdTextDrawType::Line : SwkbdTextDrawType::Box;
+
+    Core::Frontend::KeyboardInitializeParameters initialize_parameters{
+        .ok_text{std::move(ok_text)},
+        .header_text{},
+        .sub_text{},
+        .guide_text{},
+        .initial_text{current_text},
+        .max_text_length{max_text_length},
+        .min_text_length{min_text_length},
+        .initial_cursor_position{initial_cursor_position},
+        .type{appear_arg.type},
+        .password_mode{SwkbdPasswordMode::Disabled},
+        .text_draw_type{text_draw_type},
+        .key_disable_flags{appear_arg.key_disable_flags},
+        .use_blur_background{false},
+        .enable_backspace_button{swkbd_calc_arg_old.enable_backspace_button},
+        .enable_return_button{appear_arg.enable_return_button},
+        .disable_cancel_button{appear_arg.disable_cancel_button},
+    };
+
+    InitializeFrontendInlineKeyboard(std::move(initialize_parameters));
+}
+
+void SoftwareKeyboard::InitializeFrontendInlineKeyboardNew() {
+    const auto& appear_arg = swkbd_calc_arg_new.appear_arg;
+
+    std::u16string ok_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
+        appear_arg.ok_text.data(), appear_arg.ok_text.size());
+
+    const u32 max_text_length =
+        appear_arg.max_text_length > 0 && appear_arg.max_text_length <= DEFAULT_MAX_TEXT_LENGTH
+            ? appear_arg.max_text_length
+            : DEFAULT_MAX_TEXT_LENGTH;
+
+    const u32 min_text_length =
+        appear_arg.min_text_length <= max_text_length ? appear_arg.min_text_length : 0;
+
+    const s32 initial_cursor_position = current_cursor_position > 0 ? current_cursor_position : 0;
+
+    const auto text_draw_type =
+        max_text_length <= 32 ? SwkbdTextDrawType::Line : SwkbdTextDrawType::Box;
+
+    Core::Frontend::KeyboardInitializeParameters initialize_parameters{
+        .ok_text{std::move(ok_text)},
+        .header_text{},
+        .sub_text{},
+        .guide_text{},
+        .initial_text{current_text},
+        .max_text_length{max_text_length},
+        .min_text_length{min_text_length},
+        .initial_cursor_position{initial_cursor_position},
+        .type{appear_arg.type},
+        .password_mode{SwkbdPasswordMode::Disabled},
+        .text_draw_type{text_draw_type},
+        .key_disable_flags{appear_arg.key_disable_flags},
+        .use_blur_background{false},
+        .enable_backspace_button{swkbd_calc_arg_new.enable_backspace_button},
+        .enable_return_button{appear_arg.enable_return_button},
+        .disable_cancel_button{appear_arg.disable_cancel_button},
+    };
+
+    InitializeFrontendInlineKeyboard(std::move(initialize_parameters));
 }
 
 void SoftwareKeyboard::ShowNormalKeyboard() {
@@ -614,14 +658,21 @@ void SoftwareKeyboard::ShowTextCheckDialog(SwkbdTextCheckResult text_check_resul
     frontend.ShowTextCheckDialog(text_check_result, std::move(text_check_message));
 }
 
-void SoftwareKeyboard::ShowInlineKeyboard() {
+void SoftwareKeyboard::ShowInlineKeyboard(
+    Core::Frontend::InlineAppearParameters appear_parameters) {
+    frontend.ShowInlineKeyboard(std::move(appear_parameters));
+
+    ChangeState(SwkbdState::InitializedIsShown);
+}
+
+void SoftwareKeyboard::ShowInlineKeyboardOld() {
     if (swkbd_state != SwkbdState::InitializedIsHidden) {
         return;
     }
 
     ChangeState(SwkbdState::InitializedIsAppearing);
 
-    const auto& appear_arg = swkbd_calc_arg.appear_arg;
+    const auto& appear_arg = swkbd_calc_arg_old.appear_arg;
 
     const u32 max_text_length =
         appear_arg.max_text_length > 0 && appear_arg.max_text_length <= DEFAULT_MAX_TEXT_LENGTH
@@ -634,21 +685,54 @@ void SoftwareKeyboard::ShowInlineKeyboard() {
     Core::Frontend::InlineAppearParameters appear_parameters{
         .max_text_length{max_text_length},
         .min_text_length{min_text_length},
-        .key_top_scale_x{swkbd_calc_arg.key_top_scale_x},
-        .key_top_scale_y{swkbd_calc_arg.key_top_scale_y},
-        .key_top_translate_x{swkbd_calc_arg.key_top_translate_x},
-        .key_top_translate_y{swkbd_calc_arg.key_top_translate_y},
+        .key_top_scale_x{swkbd_calc_arg_old.key_top_scale_x},
+        .key_top_scale_y{swkbd_calc_arg_old.key_top_scale_y},
+        .key_top_translate_x{swkbd_calc_arg_old.key_top_translate_x},
+        .key_top_translate_y{swkbd_calc_arg_old.key_top_translate_y},
         .type{appear_arg.type},
         .key_disable_flags{appear_arg.key_disable_flags},
-        .key_top_as_floating{swkbd_calc_arg.key_top_as_floating},
-        .enable_backspace_button{swkbd_calc_arg.enable_backspace_button},
+        .key_top_as_floating{swkbd_calc_arg_old.key_top_as_floating},
+        .enable_backspace_button{swkbd_calc_arg_old.enable_backspace_button},
         .enable_return_button{appear_arg.enable_return_button},
         .disable_cancel_button{appear_arg.disable_cancel_button},
     };
 
-    frontend.ShowInlineKeyboard(std::move(appear_parameters));
+    ShowInlineKeyboard(std::move(appear_parameters));
+}
 
-    ChangeState(SwkbdState::InitializedIsShown);
+void SoftwareKeyboard::ShowInlineKeyboardNew() {
+    if (swkbd_state != SwkbdState::InitializedIsHidden) {
+        return;
+    }
+
+    ChangeState(SwkbdState::InitializedIsAppearing);
+
+    const auto& appear_arg = swkbd_calc_arg_new.appear_arg;
+
+    const u32 max_text_length =
+        appear_arg.max_text_length > 0 && appear_arg.max_text_length <= DEFAULT_MAX_TEXT_LENGTH
+            ? appear_arg.max_text_length
+            : DEFAULT_MAX_TEXT_LENGTH;
+
+    const u32 min_text_length =
+        appear_arg.min_text_length <= max_text_length ? appear_arg.min_text_length : 0;
+
+    Core::Frontend::InlineAppearParameters appear_parameters{
+        .max_text_length{max_text_length},
+        .min_text_length{min_text_length},
+        .key_top_scale_x{swkbd_calc_arg_new.key_top_scale_x},
+        .key_top_scale_y{swkbd_calc_arg_new.key_top_scale_y},
+        .key_top_translate_x{swkbd_calc_arg_new.key_top_translate_x},
+        .key_top_translate_y{swkbd_calc_arg_new.key_top_translate_y},
+        .type{appear_arg.type},
+        .key_disable_flags{appear_arg.key_disable_flags},
+        .key_top_as_floating{swkbd_calc_arg_new.key_top_as_floating},
+        .enable_backspace_button{swkbd_calc_arg_new.enable_backspace_button},
+        .enable_return_button{appear_arg.enable_return_button},
+        .disable_cancel_button{appear_arg.disable_cancel_button},
+    };
+
+    ShowInlineKeyboard(std::move(appear_parameters));
 }
 
 void SoftwareKeyboard::HideInlineKeyboard() {
@@ -693,6 +777,8 @@ void SoftwareKeyboard::RequestFinalize(const std::vector<u8>& request_data) {
 
 void SoftwareKeyboard::RequestSetUserWordInfo(const std::vector<u8>& request_data) {
     LOG_WARNING(Service_AM, "SetUserWordInfo is not implemented.");
+
+    ReplyReleasedUserWordInfo();
 }
 
 void SoftwareKeyboard::RequestSetCustomizeDic(const std::vector<u8>& request_data) {
@@ -702,53 +788,135 @@ void SoftwareKeyboard::RequestSetCustomizeDic(const std::vector<u8>& request_dat
 void SoftwareKeyboard::RequestCalc(const std::vector<u8>& request_data) {
     LOG_DEBUG(Service_AM, "Processing Request: Calc");
 
-    ASSERT(request_data.size() == sizeof(SwkbdRequestCommand) + sizeof(SwkbdCalcArg));
+    ASSERT(request_data.size() >= sizeof(SwkbdRequestCommand) + sizeof(SwkbdCalcArgCommon));
 
-    std::memcpy(&swkbd_calc_arg, request_data.data() + sizeof(SwkbdRequestCommand),
-                sizeof(SwkbdCalcArg));
+    std::memcpy(&swkbd_calc_arg_common, request_data.data() + sizeof(SwkbdRequestCommand),
+                sizeof(SwkbdCalcArgCommon));
+
+    switch (swkbd_calc_arg_common.calc_arg_size) {
+    case sizeof(SwkbdCalcArgCommon) + sizeof(SwkbdCalcArgOld):
+        ASSERT(request_data.size() ==
+               sizeof(SwkbdRequestCommand) + sizeof(SwkbdCalcArgCommon) + sizeof(SwkbdCalcArgOld));
+        std::memcpy(&swkbd_calc_arg_old,
+                    request_data.data() + sizeof(SwkbdRequestCommand) + sizeof(SwkbdCalcArgCommon),
+                    sizeof(SwkbdCalcArgOld));
+        RequestCalcOld();
+        break;
+    case sizeof(SwkbdCalcArgCommon) + sizeof(SwkbdCalcArgNew):
+        ASSERT(request_data.size() ==
+               sizeof(SwkbdRequestCommand) + sizeof(SwkbdCalcArgCommon) + sizeof(SwkbdCalcArgNew));
+        std::memcpy(&swkbd_calc_arg_new,
+                    request_data.data() + sizeof(SwkbdRequestCommand) + sizeof(SwkbdCalcArgCommon),
+                    sizeof(SwkbdCalcArgNew));
+        RequestCalcNew();
+        break;
+    default:
+        UNIMPLEMENTED_MSG("Unknown SwkbdCalcArg size={}", swkbd_calc_arg_common.calc_arg_size);
+        ASSERT(request_data.size() >=
+               sizeof(SwkbdRequestCommand) + sizeof(SwkbdCalcArgCommon) + sizeof(SwkbdCalcArgNew));
+        std::memcpy(&swkbd_calc_arg_new,
+                    request_data.data() + sizeof(SwkbdRequestCommand) + sizeof(SwkbdCalcArgCommon),
+                    sizeof(SwkbdCalcArgNew));
+        RequestCalcNew();
+        break;
+    }
+}
+
+void SoftwareKeyboard::RequestCalcOld() {
+    if (swkbd_calc_arg_common.flags.set_input_text) {
+        current_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
+            swkbd_calc_arg_old.input_text.data(), swkbd_calc_arg_old.input_text.size());
+    }
+
+    if (swkbd_calc_arg_common.flags.set_cursor_position) {
+        current_cursor_position = swkbd_calc_arg_old.cursor_position;
+    }
+
+    if (swkbd_calc_arg_common.flags.set_utf8_mode) {
+        inline_use_utf8 = swkbd_calc_arg_old.utf8_mode;
+    }
+
+    if (swkbd_state <= SwkbdState::InitializedIsHidden &&
+        swkbd_calc_arg_common.flags.unset_customize_dic) {
+        ReplyUnsetCustomizeDic();
+    }
+
+    if (swkbd_state <= SwkbdState::InitializedIsHidden &&
+        swkbd_calc_arg_common.flags.unset_user_word_info) {
+        ReplyReleasedUserWordInfo();
+    }
+
+    if (swkbd_state == SwkbdState::NotInitialized &&
+        swkbd_calc_arg_common.flags.set_initialize_arg) {
+        InitializeFrontendInlineKeyboardOld();
+
+        ChangeState(SwkbdState::InitializedIsHidden);
+
+        ReplyFinishedInitialize();
+    }
+
+    if (!swkbd_calc_arg_common.flags.set_initialize_arg &&
+        (swkbd_calc_arg_common.flags.set_input_text ||
+         swkbd_calc_arg_common.flags.set_cursor_position)) {
+        InlineTextChanged();
+    }
+
+    if (swkbd_state == SwkbdState::InitializedIsHidden && swkbd_calc_arg_common.flags.appear) {
+        ShowInlineKeyboardOld();
+        return;
+    }
+
+    if (swkbd_state == SwkbdState::InitializedIsShown && swkbd_calc_arg_common.flags.disappear) {
+        HideInlineKeyboard();
+        return;
+    }
+}
 
-    if (swkbd_calc_arg.flags.set_input_text) {
+void SoftwareKeyboard::RequestCalcNew() {
+    if (swkbd_calc_arg_common.flags.set_input_text) {
         current_text = Common::UTF16StringFromFixedZeroTerminatedBuffer(
-            swkbd_calc_arg.input_text.data(), swkbd_calc_arg.input_text.size());
+            swkbd_calc_arg_new.input_text.data(), swkbd_calc_arg_new.input_text.size());
     }
 
-    if (swkbd_calc_arg.flags.set_cursor_position) {
-        current_cursor_position = swkbd_calc_arg.cursor_position;
+    if (swkbd_calc_arg_common.flags.set_cursor_position) {
+        current_cursor_position = swkbd_calc_arg_new.cursor_position;
     }
 
-    if (swkbd_calc_arg.flags.set_utf8_mode) {
-        inline_use_utf8 = swkbd_calc_arg.utf8_mode;
+    if (swkbd_calc_arg_common.flags.set_utf8_mode) {
+        inline_use_utf8 = swkbd_calc_arg_new.utf8_mode;
     }
 
     if (swkbd_state <= SwkbdState::InitializedIsHidden &&
-        swkbd_calc_arg.flags.unset_customize_dic) {
+        swkbd_calc_arg_common.flags.unset_customize_dic) {
         ReplyUnsetCustomizeDic();
     }
 
     if (swkbd_state <= SwkbdState::InitializedIsHidden &&
-        swkbd_calc_arg.flags.unset_user_word_info) {
+        swkbd_calc_arg_common.flags.unset_user_word_info) {
         ReplyReleasedUserWordInfo();
     }
 
-    if (swkbd_state == SwkbdState::NotInitialized && swkbd_calc_arg.flags.set_initialize_arg) {
-        InitializeFrontendKeyboard();
+    if (swkbd_state == SwkbdState::NotInitialized &&
+        swkbd_calc_arg_common.flags.set_initialize_arg) {
+        InitializeFrontendInlineKeyboardNew();
 
         ChangeState(SwkbdState::InitializedIsHidden);
 
         ReplyFinishedInitialize();
     }
 
-    if (!swkbd_calc_arg.flags.set_initialize_arg &&
-        (swkbd_calc_arg.flags.set_input_text || swkbd_calc_arg.flags.set_cursor_position)) {
+    if (!swkbd_calc_arg_common.flags.set_initialize_arg &&
+        (swkbd_calc_arg_common.flags.set_input_text ||
+         swkbd_calc_arg_common.flags.set_cursor_position)) {
         InlineTextChanged();
     }
 
-    if (swkbd_state == SwkbdState::InitializedIsHidden && swkbd_calc_arg.flags.appear) {
-        ShowInlineKeyboard();
+    if (swkbd_state == SwkbdState::InitializedIsHidden && swkbd_calc_arg_common.flags.appear) {
+        ShowInlineKeyboardNew();
         return;
     }
 
-    if (swkbd_state == SwkbdState::InitializedIsShown && swkbd_calc_arg.flags.disappear) {
+    if (swkbd_state == SwkbdState::InitializedIsShown && swkbd_calc_arg_common.flags.disappear) {
         HideInlineKeyboard();
         return;
     }
diff --git a/src/core/hle/service/am/applets/applet_software_keyboard.h b/src/core/hle/service/am/applets/applet_software_keyboard.h
index a0fddd965..7ee4c5eea 100644
--- a/src/core/hle/service/am/applets/applet_software_keyboard.h
+++ b/src/core/hle/service/am/applets/applet_software_keyboard.h
@@ -13,6 +13,11 @@ namespace Core {
 class System;
 }
 
+namespace Core::Frontend {
+struct KeyboardInitializeParameters;
+struct InlineAppearParameters;
+} // namespace Core::Frontend
+
 namespace Service::AM::Applets {
 
 class SoftwareKeyboard final : public Applet {
@@ -78,13 +83,22 @@ private:
     void ChangeState(SwkbdState state);
 
     /**
-     * Signals the frontend to initialize the software keyboard with common parameters.
-     * This initializes either the normal software keyboard or the inline software keyboard
-     * depending on the state of is_background.
+     * Signals the frontend to initialize the normal software keyboard with common parameters.
      * Note that this does not cause the keyboard to appear.
-     * Use the respective Show*Keyboard() functions to cause the respective keyboards to appear.
+     * Use the ShowNormalKeyboard() functions to cause the keyboard to appear.
      */
-    void InitializeFrontendKeyboard();
+    void InitializeFrontendNormalKeyboard();
+
+    /**
+     * Signals the frontend to initialize the inline software keyboard with common parameters.
+     * Note that this does not cause the keyboard to appear.
+     * Use the ShowInlineKeyboard() to cause the keyboard to appear.
+     */
+    void InitializeFrontendInlineKeyboard(
+        Core::Frontend::KeyboardInitializeParameters initialize_parameters);
+
+    void InitializeFrontendInlineKeyboardOld();
+    void InitializeFrontendInlineKeyboardNew();
 
     /// Signals the frontend to show the normal software keyboard.
     void ShowNormalKeyboard();
@@ -94,7 +108,10 @@ private:
                              std::u16string text_check_message);
 
     /// Signals the frontend to show the inline software keyboard.
-    void ShowInlineKeyboard();
+    void ShowInlineKeyboard(Core::Frontend::InlineAppearParameters appear_parameters);
+
+    void ShowInlineKeyboardOld();
+    void ShowInlineKeyboardNew();
 
     /// Signals the frontend to hide the inline software keyboard.
     void HideInlineKeyboard();
@@ -111,6 +128,8 @@ private:
     void RequestSetUserWordInfo(const std::vector<u8>& request_data);
     void RequestSetCustomizeDic(const std::vector<u8>& request_data);
     void RequestCalc(const std::vector<u8>& request_data);
+    void RequestCalcOld();
+    void RequestCalcNew();
     void RequestSetCustomizedDictionaries(const std::vector<u8>& request_data);
     void RequestUnsetCustomizedDictionaries(const std::vector<u8>& request_data);
     void RequestSetChangedStringV2Flag(const std::vector<u8>& request_data);
@@ -149,7 +168,9 @@ private:
 
     SwkbdState swkbd_state{SwkbdState::NotInitialized};
     SwkbdInitializeArg swkbd_initialize_arg;
-    SwkbdCalcArg swkbd_calc_arg;
+    SwkbdCalcArgCommon swkbd_calc_arg_common;
+    SwkbdCalcArgOld swkbd_calc_arg_old;
+    SwkbdCalcArgNew swkbd_calc_arg_new;
     bool use_changed_string_v2{false};
     bool use_moved_cursor_v2{false};
     bool inline_use_utf8{false};
diff --git a/src/core/hle/service/am/applets/applet_software_keyboard_types.h b/src/core/hle/service/am/applets/applet_software_keyboard_types.h
index 21aa8e800..de1ca7aa5 100644
--- a/src/core/hle/service/am/applets/applet_software_keyboard_types.h
+++ b/src/core/hle/service/am/applets/applet_software_keyboard_types.h
@@ -10,6 +10,7 @@
 #include "common/common_funcs.h"
 #include "common/common_types.h"
 #include "common/swap.h"
+#include "common/uuid.h"
 
 namespace Service::AM::Applets {
 
@@ -216,7 +217,7 @@ struct SwkbdInitializeArg {
 };
 static_assert(sizeof(SwkbdInitializeArg) == 0x8, "SwkbdInitializeArg has incorrect size.");
 
-struct SwkbdAppearArg {
+struct SwkbdAppearArgOld {
     SwkbdType type{};
     std::array<char16_t, MAX_OK_TEXT_LENGTH + 1> ok_text{};
     char16_t left_optional_symbol_key{};
@@ -229,19 +230,76 @@ struct SwkbdAppearArg {
     bool enable_return_button{};
     INSERT_PADDING_BYTES(3);
     u32 flags{};
-    INSERT_PADDING_WORDS(6);
+    bool is_use_save_data{};
+    INSERT_PADDING_BYTES(7);
+    Common::UUID user_id{};
 };
-static_assert(sizeof(SwkbdAppearArg) == 0x48, "SwkbdAppearArg has incorrect size.");
+static_assert(sizeof(SwkbdAppearArgOld) == 0x48, "SwkbdAppearArg has incorrect size.");
 
-struct SwkbdCalcArg {
+struct SwkbdAppearArgNew {
+    SwkbdType type{};
+    std::array<char16_t, MAX_OK_TEXT_LENGTH + 1> ok_text{};
+    char16_t left_optional_symbol_key{};
+    char16_t right_optional_symbol_key{};
+    bool use_prediction{};
+    bool disable_cancel_button{};
+    SwkbdKeyDisableFlags key_disable_flags{};
+    u32 max_text_length{};
+    u32 min_text_length{};
+    bool enable_return_button{};
+    INSERT_PADDING_BYTES(3);
+    u32 flags{};
+    bool is_use_save_data{};
+    INSERT_PADDING_BYTES(7);
+    Common::UUID user_id{};
+    u64 start_sampling_number{};
+    INSERT_PADDING_WORDS(8);
+};
+static_assert(sizeof(SwkbdAppearArgNew) == 0x70, "SwkbdAppearArg has incorrect size.");
+
+struct SwkbdCalcArgCommon {
     u32 unknown{};
     u16 calc_arg_size{};
     INSERT_PADDING_BYTES(2);
     SwkbdCalcArgFlags flags{};
     SwkbdInitializeArg initialize_arg{};
+};
+static_assert(sizeof(SwkbdCalcArgCommon) == 0x18, "SwkbdCalcArgCommon has incorrect size.");
+
+struct SwkbdCalcArgOld {
+    f32 volume{};
+    s32 cursor_position{};
+    SwkbdAppearArgOld appear_arg{};
+    std::array<char16_t, 0x1FA> input_text{};
+    bool utf8_mode{};
+    INSERT_PADDING_BYTES(1);
+    bool enable_backspace_button{};
+    INSERT_PADDING_BYTES(3);
+    bool key_top_as_floating{};
+    bool footer_scalable{};
+    bool alpha_enabled_in_input_mode{};
+    u8 input_mode_fade_type{};
+    bool disable_touch{};
+    bool disable_hardware_keyboard{};
+    INSERT_PADDING_BYTES(8);
+    f32 key_top_scale_x{};
+    f32 key_top_scale_y{};
+    f32 key_top_translate_x{};
+    f32 key_top_translate_y{};
+    f32 key_top_bg_alpha{};
+    f32 footer_bg_alpha{};
+    f32 balloon_scale{};
+    INSERT_PADDING_WORDS(4);
+    u8 se_group{};
+    INSERT_PADDING_BYTES(3);
+};
+static_assert(sizeof(SwkbdCalcArgOld) == 0x4A0 - sizeof(SwkbdCalcArgCommon),
+              "SwkbdCalcArgOld has incorrect size.");
+
+struct SwkbdCalcArgNew {
+    SwkbdAppearArgNew appear_arg{};
     f32 volume{};
     s32 cursor_position{};
-    SwkbdAppearArg appear_arg{};
     std::array<char16_t, 0x1FA> input_text{};
     bool utf8_mode{};
     INSERT_PADDING_BYTES(1);
@@ -264,8 +322,10 @@ struct SwkbdCalcArg {
     INSERT_PADDING_WORDS(4);
     u8 se_group{};
     INSERT_PADDING_BYTES(3);
+    INSERT_PADDING_WORDS(8);
 };
-static_assert(sizeof(SwkbdCalcArg) == 0x4A0, "SwkbdCalcArg has incorrect size.");
+static_assert(sizeof(SwkbdCalcArgNew) == 0x4E8 - sizeof(SwkbdCalcArgCommon),
+              "SwkbdCalcArgNew has incorrect size.");
 
 struct SwkbdChangedStringArg {
     u32 text_length{};
diff --git a/src/core/hle/service/am/applets/applet_web_browser.cpp b/src/core/hle/service/am/applets/applet_web_browser.cpp
index bb5cb61be..a4b3fb187 100644
--- a/src/core/hle/service/am/applets/applet_web_browser.cpp
+++ b/src/core/hle/service/am/applets/applet_web_browser.cpp
@@ -446,6 +446,14 @@ void WebBrowser::ExecuteLogin() {
 }
 
 void WebBrowser::ExecuteOffline() {
+    // TODO (Morph): This is a hack for WebSession foreground web applets such as those used by
+    //               Super Mario 3D All-Stars.
+    // TODO (Morph): Implement WebSession.
+    if (applet_mode == LibraryAppletMode::AllForegroundInitiallyHidden) {
+        LOG_WARNING(Service_AM, "WebSession is not implemented");
+        return;
+    }
+
     const auto main_url = GetMainURL(Common::FS::PathToUTF8String(offline_document));
 
     if (!Common::FS::Exists(main_url)) {
diff --git a/src/core/hle/service/am/applets/applets.cpp b/src/core/hle/service/am/applets/applets.cpp
index 134ac1ee2..1f4c9786a 100644
--- a/src/core/hle/service/am/applets/applets.cpp
+++ b/src/core/hle/service/am/applets/applets.cpp
@@ -9,6 +9,7 @@
 #include "core/frontend/applets/controller.h"
 #include "core/frontend/applets/error.h"
 #include "core/frontend/applets/general_frontend.h"
+#include "core/frontend/applets/mii_edit.h"
 #include "core/frontend/applets/profile_select.h"
 #include "core/frontend/applets/software_keyboard.h"
 #include "core/frontend/applets/web_browser.h"
@@ -19,6 +20,7 @@
 #include "core/hle/service/am/applets/applet_controller.h"
 #include "core/hle/service/am/applets/applet_error.h"
 #include "core/hle/service/am/applets/applet_general_backend.h"
+#include "core/hle/service/am/applets/applet_mii_edit.h"
 #include "core/hle/service/am/applets/applet_profile_select.h"
 #include "core/hle/service/am/applets/applet_software_keyboard.h"
 #include "core/hle/service/am/applets/applet_web_browser.h"
@@ -171,11 +173,12 @@ void Applet::Initialize() {
 AppletFrontendSet::AppletFrontendSet() = default;
 
 AppletFrontendSet::AppletFrontendSet(ControllerApplet controller_applet, ErrorApplet error_applet,
+                                     MiiEdit mii_edit_,
                                      ParentalControlsApplet parental_controls_applet,
                                      PhotoViewer photo_viewer_, ProfileSelect profile_select_,
                                      SoftwareKeyboard software_keyboard_, WebBrowser web_browser_)
     : controller{std::move(controller_applet)}, error{std::move(error_applet)},
-      parental_controls{std::move(parental_controls_applet)},
+      mii_edit{std::move(mii_edit_)}, parental_controls{std::move(parental_controls_applet)},
       photo_viewer{std::move(photo_viewer_)}, profile_select{std::move(profile_select_)},
       software_keyboard{std::move(software_keyboard_)}, web_browser{std::move(web_browser_)} {}
 
@@ -202,6 +205,10 @@ void AppletManager::SetAppletFrontendSet(AppletFrontendSet set) {
         frontend.error = std::move(set.error);
     }
 
+    if (set.mii_edit != nullptr) {
+        frontend.mii_edit = std::move(set.mii_edit);
+    }
+
     if (set.parental_controls != nullptr) {
         frontend.parental_controls = std::move(set.parental_controls);
     }
@@ -238,6 +245,10 @@ void AppletManager::SetDefaultAppletsIfMissing() {
         frontend.error = std::make_unique<Core::Frontend::DefaultErrorApplet>();
     }
 
+    if (frontend.mii_edit == nullptr) {
+        frontend.mii_edit = std::make_unique<Core::Frontend::DefaultMiiEditApplet>();
+    }
+
     if (frontend.parental_controls == nullptr) {
         frontend.parental_controls =
             std::make_unique<Core::Frontend::DefaultParentalControlsApplet>();
@@ -277,6 +288,8 @@ std::shared_ptr<Applet> AppletManager::GetApplet(AppletId id, LibraryAppletMode
         return std::make_shared<ProfileSelect>(system, mode, *frontend.profile_select);
     case AppletId::SoftwareKeyboard:
         return std::make_shared<SoftwareKeyboard>(system, mode, *frontend.software_keyboard);
+    case AppletId::MiiEdit:
+        return std::make_shared<MiiEdit>(system, mode, *frontend.mii_edit);
     case AppletId::Web:
     case AppletId::Shop:
     case AppletId::OfflineWeb:
diff --git a/src/core/hle/service/am/applets/applets.h b/src/core/hle/service/am/applets/applets.h
index 15eeb4ee1..50a7bdceb 100644
--- a/src/core/hle/service/am/applets/applets.h
+++ b/src/core/hle/service/am/applets/applets.h
@@ -20,6 +20,7 @@ namespace Core::Frontend {
 class ControllerApplet;
 class ECommerceApplet;
 class ErrorApplet;
+class MiiEditApplet;
 class ParentalControlsApplet;
 class PhotoViewerApplet;
 class ProfileSelectApplet;
@@ -178,6 +179,7 @@ protected:
 struct AppletFrontendSet {
     using ControllerApplet = std::unique_ptr<Core::Frontend::ControllerApplet>;
     using ErrorApplet = std::unique_ptr<Core::Frontend::ErrorApplet>;
+    using MiiEdit = std::unique_ptr<Core::Frontend::MiiEditApplet>;
     using ParentalControlsApplet = std::unique_ptr<Core::Frontend::ParentalControlsApplet>;
     using PhotoViewer = std::unique_ptr<Core::Frontend::PhotoViewerApplet>;
     using ProfileSelect = std::unique_ptr<Core::Frontend::ProfileSelectApplet>;
@@ -186,9 +188,9 @@ struct AppletFrontendSet {
 
     AppletFrontendSet();
     AppletFrontendSet(ControllerApplet controller_applet, ErrorApplet error_applet,
-                      ParentalControlsApplet parental_controls_applet, PhotoViewer photo_viewer_,
-                      ProfileSelect profile_select_, SoftwareKeyboard software_keyboard_,
-                      WebBrowser web_browser_);
+                      MiiEdit mii_edit_, ParentalControlsApplet parental_controls_applet,
+                      PhotoViewer photo_viewer_, ProfileSelect profile_select_,
+                      SoftwareKeyboard software_keyboard_, WebBrowser web_browser_);
     ~AppletFrontendSet();
 
     AppletFrontendSet(const AppletFrontendSet&) = delete;
@@ -199,6 +201,7 @@ struct AppletFrontendSet {
 
     ControllerApplet controller;
     ErrorApplet error;
+    MiiEdit mii_edit;
     ParentalControlsApplet parental_controls;
     PhotoViewer photo_viewer;
     ProfileSelect profile_select;
diff --git a/src/core/hle/service/audio/audout_u.cpp b/src/core/hle/service/audio/audout_u.cpp
index affa7971c..a72956a28 100644
--- a/src/core/hle/service/audio/audout_u.cpp
+++ b/src/core/hle/service/audio/audout_u.cpp
@@ -41,9 +41,10 @@ public:
     explicit IAudioOut(Core::System& system_, AudoutParams audio_params_,
                        AudioCore::AudioOut& audio_core_, std::string&& device_name_,
                        std::string&& unique_name)
-        : ServiceFramework{system_, "IAudioOut"}, audio_core{audio_core_},
-          device_name{std::move(device_name_)}, audio_params{audio_params_},
-          main_memory{system.Memory()}, service_context{system_, "IAudioOut"} {
+        : ServiceFramework{system_, "IAudioOut", ServiceThreadType::CreateNew},
+          audio_core{audio_core_}, device_name{std::move(device_name_)},
+          audio_params{audio_params_}, main_memory{system.Memory()}, service_context{system_,
+                                                                                     "IAudioOut"} {
         // clang-format off
         static const FunctionInfo functions[] = {
             {0, &IAudioOut::GetAudioOutState, "GetAudioOutState"},
diff --git a/src/core/hle/service/audio/audren_u.cpp b/src/core/hle/service/audio/audren_u.cpp
index f45e5cecc..d4ffeb21d 100644
--- a/src/core/hle/service/audio/audren_u.cpp
+++ b/src/core/hle/service/audio/audren_u.cpp
@@ -24,7 +24,8 @@ public:
     explicit IAudioRenderer(Core::System& system_,
                             const AudioCommon::AudioRendererParameter& audren_params,
                             const std::size_t instance_number)
-        : ServiceFramework{system_, "IAudioRenderer"}, service_context{system_, "IAudioRenderer"} {
+        : ServiceFramework{system_, "IAudioRenderer", ServiceThreadType::CreateNew},
+          service_context{system_, "IAudioRenderer"} {
         // clang-format off
         static const FunctionInfo functions[] = {
             {0, &IAudioRenderer::GetSampleRate, "GetSampleRate"},
diff --git a/src/core/hle/service/filesystem/filesystem.cpp b/src/core/hle/service/filesystem/filesystem.cpp
index 3703ca4c6..4208337db 100644
--- a/src/core/hle/service/filesystem/filesystem.cpp
+++ b/src/core/hle/service/filesystem/filesystem.cpp
@@ -174,7 +174,7 @@ ResultCode VfsDirectoryServiceWrapper::RenameFile(const std::string& src_path_,
     ASSERT_MSG(dest != nullptr, "Newly created file with success cannot be found.");
 
     ASSERT_MSG(dest->WriteBytes(src->ReadAllBytes()) == src->GetSize(),
-               "Could not write all of the bytes but everything else has succeded.");
+               "Could not write all of the bytes but everything else has succeeded.");
 
     if (!src->GetContainingDirectory()->DeleteFile(Common::FS::GetFilename(src_path))) {
         // TODO(DarkLordZach): Find a better error code for this
diff --git a/src/core/hle/service/filesystem/fsp_srv.cpp b/src/core/hle/service/filesystem/fsp_srv.cpp
index b087e7bba..c07929ab8 100644
--- a/src/core/hle/service/filesystem/fsp_srv.cpp
+++ b/src/core/hle/service/filesystem/fsp_srv.cpp
@@ -58,7 +58,8 @@ enum class FileSystemType : u8 {
 class IStorage final : public ServiceFramework<IStorage> {
 public:
     explicit IStorage(Core::System& system_, FileSys::VirtualFile backend_)
-        : ServiceFramework{system_, "IStorage"}, backend(std::move(backend_)) {
+        : ServiceFramework{system_, "IStorage", ServiceThreadType::CreateNew},
+          backend(std::move(backend_)) {
         static const FunctionInfo functions[] = {
             {0, &IStorage::Read, "Read"},
             {1, nullptr, "Write"},
@@ -116,7 +117,8 @@ private:
 class IFile final : public ServiceFramework<IFile> {
 public:
     explicit IFile(Core::System& system_, FileSys::VirtualFile backend_)
-        : ServiceFramework{system_, "IFile"}, backend(std::move(backend_)) {
+        : ServiceFramework{system_, "IFile", ServiceThreadType::CreateNew},
+          backend(std::move(backend_)) {
         static const FunctionInfo functions[] = {
             {0, &IFile::Read, "Read"},
             {1, &IFile::Write, "Write"},
@@ -252,7 +254,8 @@ static void BuildEntryIndex(std::vector<FileSys::Entry>& entries, const std::vec
 class IDirectory final : public ServiceFramework<IDirectory> {
 public:
     explicit IDirectory(Core::System& system_, FileSys::VirtualDir backend_)
-        : ServiceFramework{system_, "IDirectory"}, backend(std::move(backend_)) {
+        : ServiceFramework{system_, "IDirectory", ServiceThreadType::CreateNew},
+          backend(std::move(backend_)) {
         static const FunctionInfo functions[] = {
             {0, &IDirectory::Read, "Read"},
             {1, &IDirectory::GetEntryCount, "GetEntryCount"},
@@ -308,8 +311,8 @@ private:
 class IFileSystem final : public ServiceFramework<IFileSystem> {
 public:
     explicit IFileSystem(Core::System& system_, FileSys::VirtualDir backend_, SizeGetter size_)
-        : ServiceFramework{system_, "IFileSystem"}, backend{std::move(backend_)}, size{std::move(
-                                                                                      size_)} {
+        : ServiceFramework{system_, "IFileSystem", ServiceThreadType::CreateNew},
+          backend{std::move(backend_)}, size{std::move(size_)} {
         static const FunctionInfo functions[] = {
             {0, &IFileSystem::CreateFile, "CreateFile"},
             {1, &IFileSystem::DeleteFile, "DeleteFile"},
diff --git a/src/core/hle/service/hid/controllers/console_sixaxis.cpp b/src/core/hle/service/hid/controllers/console_sixaxis.cpp
index a727b3582..8450eaf93 100644
--- a/src/core/hle/service/hid/controllers/console_sixaxis.cpp
+++ b/src/core/hle/service/hid/controllers/console_sixaxis.cpp
@@ -2,7 +2,6 @@
 // Licensed under GPLv2 or any later version
 // Refer to the license.txt file included.
 
-#include "common/settings.h"
 #include "core/core_timing.h"
 #include "core/hid/emulated_console.h"
 #include "core/hid/hid_core.h"
diff --git a/src/core/hle/service/hid/controllers/console_sixaxis.h b/src/core/hle/service/hid/controllers/console_sixaxis.h
index 26d153f0c..93454585a 100644
--- a/src/core/hle/service/hid/controllers/console_sixaxis.h
+++ b/src/core/hle/service/hid/controllers/console_sixaxis.h
@@ -8,7 +8,6 @@
 
 #include "common/common_types.h"
 #include "common/quaternion.h"
-#include "core/hid/hid_types.h"
 #include "core/hle/service/hid/controllers/controller_base.h"
 #include "core/hle/service/hid/ring_lifo.h"
 
diff --git a/src/core/hle/service/hid/controllers/controller_base.h b/src/core/hle/service/hid/controllers/controller_base.h
index 7450eb20a..5e464149c 100644
--- a/src/core/hle/service/hid/controllers/controller_base.h
+++ b/src/core/hle/service/hid/controllers/controller_base.h
@@ -5,7 +5,6 @@
 #pragma once
 
 #include "common/common_types.h"
-#include "common/swap.h"
 
 namespace Core::Timing {
 class CoreTiming;
diff --git a/src/core/hle/service/hid/controllers/debug_pad.h b/src/core/hle/service/hid/controllers/debug_pad.h
index afe374fc2..4396780a1 100644
--- a/src/core/hle/service/hid/controllers/debug_pad.h
+++ b/src/core/hle/service/hid/controllers/debug_pad.h
@@ -4,11 +4,8 @@
 
 #pragma once
 
-#include <array>
 #include "common/bit_field.h"
-#include "common/common_funcs.h"
 #include "common/common_types.h"
-#include "common/swap.h"
 #include "core/hle/service/hid/controllers/controller_base.h"
 #include "core/hle/service/hid/ring_lifo.h"
 
diff --git a/src/core/hle/service/hid/controllers/keyboard.h b/src/core/hle/service/hid/controllers/keyboard.h
index cf62d3896..b869352b9 100644
--- a/src/core/hle/service/hid/controllers/keyboard.h
+++ b/src/core/hle/service/hid/controllers/keyboard.h
@@ -4,11 +4,7 @@
 
 #pragma once
 
-#include <array>
-#include "common/bit_field.h"
-#include "common/common_funcs.h"
 #include "common/common_types.h"
-#include "common/swap.h"
 #include "core/hle/service/hid/controllers/controller_base.h"
 #include "core/hle/service/hid/ring_lifo.h"
 
diff --git a/src/core/hle/service/hid/controllers/mouse.h b/src/core/hle/service/hid/controllers/mouse.h
index 7559fc78d..8858887b2 100644
--- a/src/core/hle/service/hid/controllers/mouse.h
+++ b/src/core/hle/service/hid/controllers/mouse.h
@@ -4,10 +4,7 @@
 
 #pragma once
 
-#include <array>
-#include "common/bit_field.h"
 #include "common/common_types.h"
-#include "common/swap.h"
 #include "core/hle/service/hid/controllers/controller_base.h"
 #include "core/hle/service/hid/ring_lifo.h"
 
diff --git a/src/core/hle/service/hid/controllers/npad.cpp b/src/core/hle/service/hid/controllers/npad.cpp
index e5c951e06..4e17a952e 100644
--- a/src/core/hle/service/hid/controllers/npad.cpp
+++ b/src/core/hle/service/hid/controllers/npad.cpp
@@ -262,11 +262,6 @@ void Controller_NPad::OnInit() {
             service_context.CreateEvent(fmt::format("npad:NpadStyleSetChanged_{}", i));
     }
 
-    if (hid_core.GetSupportedStyleTag().raw == Core::HID::NpadStyleSet::None) {
-        // We want to support all controllers
-        hid_core.SetSupportedStyleTag({Core::HID::NpadStyleSet::All});
-    }
-
     supported_npad_id_types.resize(npad_id_list.size());
     std::memcpy(supported_npad_id_types.data(), npad_id_list.data(),
                 npad_id_list.size() * sizeof(Core::HID::NpadIdType));
@@ -288,14 +283,6 @@ void Controller_NPad::OnInit() {
             WriteEmptyEntry(npad);
         }
     }
-
-    // Connect controllers
-    for (auto& controller : controller_data) {
-        const auto& device = controller.device;
-        if (device->IsConnected()) {
-            AddNewControllerAt(device->GetNpadStyleIndex(), device->GetNpadIdType());
-        }
-    }
 }
 
 void Controller_NPad::WriteEmptyEntry(NpadInternalState& npad) {
@@ -320,6 +307,7 @@ void Controller_NPad::WriteEmptyEntry(NpadInternalState& npad) {
 }
 
 void Controller_NPad::OnRelease() {
+    is_controller_initialized = false;
     for (std::size_t i = 0; i < controller_data.size(); ++i) {
         auto& controller = controller_data[i];
         service_context.CloseEvent(controller.styleset_changed_event);
@@ -330,7 +318,7 @@ void Controller_NPad::OnRelease() {
 }
 
 void Controller_NPad::RequestPadStateUpdate(Core::HID::NpadIdType npad_id) {
-    std::lock_guard lock{mutex};
+    std::scoped_lock lock{mutex};
     auto& controller = GetControllerFromNpadIdType(npad_id);
     const auto controller_type = controller.device->GetNpadStyleIndex();
     if (!controller.device->IsConnected()) {
@@ -651,9 +639,27 @@ void Controller_NPad::OnMotionUpdate(const Core::Timing::CoreTiming& core_timing
 
 void Controller_NPad::SetSupportedStyleSet(Core::HID::NpadStyleTag style_set) {
     hid_core.SetSupportedStyleTag(style_set);
+
+    if (is_controller_initialized) {
+        return;
+    }
+
+    // Once SetSupportedStyleSet is called controllers are fully initialized
+    is_controller_initialized = true;
+
+    // Connect all active controllers
+    for (auto& controller : controller_data) {
+        const auto& device = controller.device;
+        if (device->IsConnected()) {
+            AddNewControllerAt(device->GetNpadStyleIndex(), device->GetNpadIdType());
+        }
+    }
 }
 
 Core::HID::NpadStyleTag Controller_NPad::GetSupportedStyleSet() const {
+    if (!is_controller_initialized) {
+        return {Core::HID::NpadStyleSet::None};
+    }
     return hid_core.GetSupportedStyleTag();
 }
 
diff --git a/src/core/hle/service/hid/controllers/npad.h b/src/core/hle/service/hid/controllers/npad.h
index 6b2872bad..967379f05 100644
--- a/src/core/hle/service/hid/controllers/npad.h
+++ b/src/core/hle/service/hid/controllers/npad.h
@@ -10,7 +10,8 @@
 
 #include "common/bit_field.h"
 #include "common/common_types.h"
-#include "common/quaternion.h"
+#include "common/vector_math.h"
+
 #include "core/hid/hid_types.h"
 #include "core/hle/service/hid/controllers/controller_base.h"
 #include "core/hle/service/hid/ring_lifo.h"
@@ -190,16 +191,16 @@ private:
 
     // This is nn::hid::detail::NpadFullKeyColorState
     struct NpadFullKeyColorState {
-        ColorAttribute attribute;
-        Core::HID::NpadControllerColor fullkey;
+        ColorAttribute attribute{ColorAttribute::NoController};
+        Core::HID::NpadControllerColor fullkey{};
     };
     static_assert(sizeof(NpadFullKeyColorState) == 0xC, "NpadFullKeyColorState is an invalid size");
 
     // This is nn::hid::detail::NpadJoyColorState
     struct NpadJoyColorState {
-        ColorAttribute attribute;
-        Core::HID::NpadControllerColor left;
-        Core::HID::NpadControllerColor right;
+        ColorAttribute attribute{ColorAttribute::NoController};
+        Core::HID::NpadControllerColor left{};
+        Core::HID::NpadControllerColor right{};
     };
     static_assert(sizeof(NpadJoyColorState) == 0x14, "NpadJoyColorState is an invalid size");
 
@@ -225,11 +226,11 @@ private:
     // This is nn::hid::NpadPalmaState
     // This is nn::hid::NpadSystemExtState
     struct NPadGenericState {
-        s64_le sampling_number;
-        Core::HID::NpadButtonState npad_buttons;
-        Core::HID::AnalogStickState l_stick;
-        Core::HID::AnalogStickState r_stick;
-        NpadAttribute connection_status;
+        s64_le sampling_number{};
+        Core::HID::NpadButtonState npad_buttons{};
+        Core::HID::AnalogStickState l_stick{};
+        Core::HID::AnalogStickState r_stick{};
+        NpadAttribute connection_status{};
         INSERT_PADDING_BYTES(4); // Reserved
     };
     static_assert(sizeof(NPadGenericState) == 0x28, "NPadGenericState is an invalid size");
@@ -252,7 +253,7 @@ private:
         Common::Vec3f gyro{};
         Common::Vec3f rotation{};
         std::array<Common::Vec3f, 3> orientation{};
-        SixAxisSensorAttribute attribute;
+        SixAxisSensorAttribute attribute{};
         INSERT_PADDING_BYTES(4); // Reserved
     };
     static_assert(sizeof(SixAxisSensorState) == 0x60, "SixAxisSensorState is an invalid size");
@@ -324,11 +325,11 @@ private:
 
     // This is nn::hid::detail::NfcXcdDeviceHandleStateImpl
     struct NfcXcdDeviceHandleStateImpl {
-        u64 handle;
-        bool is_available;
-        bool is_activated;
+        u64 handle{};
+        bool is_available{};
+        bool is_activated{};
         INSERT_PADDING_BYTES(0x6); // Reserved
-        u64 sampling_number;
+        u64 sampling_number{};
     };
     static_assert(sizeof(NfcXcdDeviceHandleStateImpl) == 0x18,
                   "NfcXcdDeviceHandleStateImpl is an invalid size");
@@ -365,8 +366,8 @@ private:
     };
 
     struct AppletFooterUi {
-        AppletFooterUiAttributes attributes;
-        AppletFooterUiType type;
+        AppletFooterUiAttributes attributes{};
+        AppletFooterUiType type{AppletFooterUiType::None};
         INSERT_PADDING_BYTES(0x5B); // Reserved
     };
     static_assert(sizeof(AppletFooterUi) == 0x60, "AppletFooterUi is an invalid size");
@@ -403,41 +404,41 @@ private:
 
     // This is nn::hid::detail::NpadInternalState
     struct NpadInternalState {
-        Core::HID::NpadStyleTag style_tag;
-        NpadJoyAssignmentMode assignment_mode;
-        NpadFullKeyColorState fullkey_color;
-        NpadJoyColorState joycon_color;
-        Lifo<NPadGenericState, hid_entry_count> fullkey_lifo;
-        Lifo<NPadGenericState, hid_entry_count> handheld_lifo;
-        Lifo<NPadGenericState, hid_entry_count> joy_dual_lifo;
-        Lifo<NPadGenericState, hid_entry_count> joy_left_lifo;
-        Lifo<NPadGenericState, hid_entry_count> joy_right_lifo;
-        Lifo<NPadGenericState, hid_entry_count> palma_lifo;
-        Lifo<NPadGenericState, hid_entry_count> system_ext_lifo;
-        Lifo<SixAxisSensorState, hid_entry_count> sixaxis_fullkey_lifo;
-        Lifo<SixAxisSensorState, hid_entry_count> sixaxis_handheld_lifo;
-        Lifo<SixAxisSensorState, hid_entry_count> sixaxis_dual_left_lifo;
-        Lifo<SixAxisSensorState, hid_entry_count> sixaxis_dual_right_lifo;
-        Lifo<SixAxisSensorState, hid_entry_count> sixaxis_left_lifo;
-        Lifo<SixAxisSensorState, hid_entry_count> sixaxis_right_lifo;
-        DeviceType device_type;
+        Core::HID::NpadStyleTag style_tag{Core::HID::NpadStyleSet::None};
+        NpadJoyAssignmentMode assignment_mode{NpadJoyAssignmentMode::Dual};
+        NpadFullKeyColorState fullkey_color{};
+        NpadJoyColorState joycon_color{};
+        Lifo<NPadGenericState, hid_entry_count> fullkey_lifo{};
+        Lifo<NPadGenericState, hid_entry_count> handheld_lifo{};
+        Lifo<NPadGenericState, hid_entry_count> joy_dual_lifo{};
+        Lifo<NPadGenericState, hid_entry_count> joy_left_lifo{};
+        Lifo<NPadGenericState, hid_entry_count> joy_right_lifo{};
+        Lifo<NPadGenericState, hid_entry_count> palma_lifo{};
+        Lifo<NPadGenericState, hid_entry_count> system_ext_lifo{};
+        Lifo<SixAxisSensorState, hid_entry_count> sixaxis_fullkey_lifo{};
+        Lifo<SixAxisSensorState, hid_entry_count> sixaxis_handheld_lifo{};
+        Lifo<SixAxisSensorState, hid_entry_count> sixaxis_dual_left_lifo{};
+        Lifo<SixAxisSensorState, hid_entry_count> sixaxis_dual_right_lifo{};
+        Lifo<SixAxisSensorState, hid_entry_count> sixaxis_left_lifo{};
+        Lifo<SixAxisSensorState, hid_entry_count> sixaxis_right_lifo{};
+        DeviceType device_type{};
         INSERT_PADDING_BYTES(0x4); // Reserved
-        NPadSystemProperties system_properties;
-        NpadSystemButtonProperties button_properties;
-        Core::HID::NpadBatteryLevel battery_level_dual;
-        Core::HID::NpadBatteryLevel battery_level_left;
-        Core::HID::NpadBatteryLevel battery_level_right;
+        NPadSystemProperties system_properties{};
+        NpadSystemButtonProperties button_properties{};
+        Core::HID::NpadBatteryLevel battery_level_dual{};
+        Core::HID::NpadBatteryLevel battery_level_left{};
+        Core::HID::NpadBatteryLevel battery_level_right{};
         union {
-            Lifo<NfcXcdDeviceHandleStateImpl, 0x2> nfc_xcd_device_lifo{};
-            AppletFooterUi applet_footer;
+            AppletFooterUi applet_footer{};
+            Lifo<NfcXcdDeviceHandleStateImpl, 0x2> nfc_xcd_device_lifo;
         };
         INSERT_PADDING_BYTES(0x20); // Unknown
-        Lifo<NpadGcTriggerState, hid_entry_count> gc_trigger_lifo;
-        NpadLarkType lark_type_l_and_main;
-        NpadLarkType lark_type_r;
-        NpadLuciaType lucia_type;
-        NpadLagonType lagon_type;
-        NpadLagerType lager_type;
+        Lifo<NpadGcTriggerState, hid_entry_count> gc_trigger_lifo{};
+        NpadLarkType lark_type_l_and_main{};
+        NpadLarkType lark_type_r{};
+        NpadLuciaType lucia_type{};
+        NpadLagonType lagon_type{};
+        NpadLagerType lager_type{};
         // FW 13.x Investigate there is some sort of bitflag related to joycons
         INSERT_PADDING_BYTES(0x4);
         INSERT_PADDING_BYTES(0xc08); // Unknown
@@ -510,7 +511,8 @@ private:
     NpadHandheldActivationMode handheld_activation_mode{NpadHandheldActivationMode::Dual};
     NpadCommunicationMode communication_mode{NpadCommunicationMode::Default};
     bool permit_vibration_session_enabled{false};
-    bool analog_stick_use_center_clamp{};
+    bool analog_stick_use_center_clamp{false};
     bool is_in_lr_assignment_mode{false};
+    bool is_controller_initialized{false};
 };
 } // namespace Service::HID
diff --git a/src/core/hle/service/hid/controllers/touchscreen.cpp b/src/core/hle/service/hid/controllers/touchscreen.cpp
index 48978e5c6..65b799e78 100644
--- a/src/core/hle/service/hid/controllers/touchscreen.cpp
+++ b/src/core/hle/service/hid/controllers/touchscreen.cpp
@@ -5,7 +5,6 @@
 #include <algorithm>
 #include <cstring>
 #include "common/common_types.h"
-#include "common/logging/log.h"
 #include "common/settings.h"
 #include "core/core.h"
 #include "core/core_timing.h"
diff --git a/src/core/hle/service/hid/controllers/touchscreen.h b/src/core/hle/service/hid/controllers/touchscreen.h
index 708dde4f0..483552767 100644
--- a/src/core/hle/service/hid/controllers/touchscreen.h
+++ b/src/core/hle/service/hid/controllers/touchscreen.h
@@ -4,11 +4,8 @@
 
 #pragma once
 
-#include "common/bit_field.h"
 #include "common/common_funcs.h"
 #include "common/common_types.h"
-#include "common/point.h"
-#include "common/swap.h"
 #include "core/hid/hid_types.h"
 #include "core/hle/service/hid/controllers/controller_base.h"
 #include "core/hle/service/hid/ring_lifo.h"
diff --git a/src/core/hle/service/hid/controllers/xpad.h b/src/core/hle/service/hid/controllers/xpad.h
index ba8db8d9d..4973e1bd9 100644
--- a/src/core/hle/service/hid/controllers/xpad.h
+++ b/src/core/hle/service/hid/controllers/xpad.h
@@ -5,9 +5,7 @@
 #pragma once
 
 #include "common/bit_field.h"
-#include "common/common_funcs.h"
 #include "common/common_types.h"
-#include "common/swap.h"
 #include "core/hid/hid_types.h"
 #include "core/hle/service/hid/controllers/controller_base.h"
 #include "core/hle/service/hid/ring_lifo.h"
diff --git a/src/core/hle/service/hid/hid.cpp b/src/core/hle/service/hid/hid.cpp
index d9202ea6c..b2cec2253 100644
--- a/src/core/hle/service/hid/hid.cpp
+++ b/src/core/hle/service/hid/hid.cpp
@@ -878,6 +878,10 @@ void Hid::AcquireNpadStyleSetUpdateEventHandle(Kernel::HLERequestContext& ctx) {
     LOG_DEBUG(Service_HID, "called, npad_id={}, applet_resource_user_id={}, unknown={}",
               parameters.npad_id, parameters.applet_resource_user_id, parameters.unknown);
 
+    // Games expect this event to be signaled after calling this function
+    applet_resource->GetController<Controller_NPad>(HidController::NPad)
+        .SignalStyleSetChangedEvent(parameters.npad_id);
+
     IPC::ResponseBuilder rb{ctx, 2, 1};
     rb.Push(ResultSuccess);
     rb.PushCopyObjects(applet_resource->GetController<Controller_NPad>(HidController::NPad)
diff --git a/src/core/hle/service/jit/jit.cpp b/src/core/hle/service/jit/jit.cpp
new file mode 100644
index 000000000..0f9e33ef6
--- /dev/null
+++ b/src/core/hle/service/jit/jit.cpp
@@ -0,0 +1,332 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#include "core/arm/symbols.h"
+#include "core/core.h"
+#include "core/hle/ipc_helpers.h"
+#include "core/hle/kernel/k_code_memory.h"
+#include "core/hle/kernel/k_transfer_memory.h"
+#include "core/hle/result.h"
+#include "core/hle/service/jit/jit.h"
+#include "core/hle/service/jit/jit_context.h"
+#include "core/hle/service/service.h"
+#include "core/memory.h"
+
+namespace Service::JIT {
+
+struct CodeRange {
+    u64 offset;
+    u64 size;
+};
+
+class IJitEnvironment final : public ServiceFramework<IJitEnvironment> {
+public:
+    explicit IJitEnvironment(Core::System& system_, CodeRange user_rx, CodeRange user_ro)
+        : ServiceFramework{system_, "IJitEnvironment", ServiceThreadType::CreateNew},
+          context{system_.Memory()} {
+        // clang-format off
+        static const FunctionInfo functions[] = {
+            {0, &IJitEnvironment::GenerateCode, "GenerateCode"},
+            {1, &IJitEnvironment::Control, "Control"},
+            {1000, &IJitEnvironment::LoadPlugin, "LoadPlugin"},
+            {1001, &IJitEnvironment::GetCodeAddress, "GetCodeAddress"},
+        };
+        // clang-format on
+
+        RegisterHandlers(functions);
+
+        // Identity map user code range into sysmodule context
+        configuration.user_ro_memory = user_ro;
+        configuration.user_rx_memory = user_rx;
+        configuration.sys_ro_memory = user_ro;
+        configuration.sys_rx_memory = user_rx;
+    }
+
+    void GenerateCode(Kernel::HLERequestContext& ctx) {
+        struct Parameters {
+            u32 data_size;
+            u64 command;
+            CodeRange cr1;
+            CodeRange cr2;
+            Struct32 data;
+        };
+
+        IPC::RequestParser rp{ctx};
+        const auto parameters{rp.PopRaw<Parameters>()};
+        std::vector<u8> input_buffer{ctx.CanReadBuffer() ? ctx.ReadBuffer() : std::vector<u8>()};
+        std::vector<u8> output_buffer(ctx.CanWriteBuffer() ? ctx.GetWriteBufferSize() : 0);
+
+        const VAddr return_ptr{context.AddHeap(0u)};
+        const VAddr cr1_in_ptr{context.AddHeap(parameters.cr1)};
+        const VAddr cr2_in_ptr{context.AddHeap(parameters.cr2)};
+        const VAddr cr1_out_ptr{
+            context.AddHeap(CodeRange{.offset = parameters.cr1.offset, .size = 0})};
+        const VAddr cr2_out_ptr{
+            context.AddHeap(CodeRange{.offset = parameters.cr2.offset, .size = 0})};
+        const VAddr input_ptr{context.AddHeap(input_buffer.data(), input_buffer.size())};
+        const VAddr output_ptr{context.AddHeap(output_buffer.data(), output_buffer.size())};
+        const VAddr data_ptr{context.AddHeap(parameters.data)};
+        const VAddr configuration_ptr{context.AddHeap(configuration)};
+
+        context.CallFunction(callbacks.GenerateCode, return_ptr, cr1_out_ptr, cr2_out_ptr,
+                             configuration_ptr, parameters.command, input_ptr, input_buffer.size(),
+                             cr1_in_ptr, cr2_in_ptr, data_ptr, parameters.data_size, output_ptr,
+                             output_buffer.size());
+
+        const s32 return_value{context.GetHeap<s32>(return_ptr)};
+
+        if (return_value == 0) {
+            system.InvalidateCpuInstructionCacheRange(configuration.user_rx_memory.offset,
+                                                      configuration.user_rx_memory.size);
+
+            if (ctx.CanWriteBuffer()) {
+                context.GetHeap(output_ptr, output_buffer.data(), output_buffer.size());
+                ctx.WriteBuffer(output_buffer.data(), output_buffer.size());
+            }
+            const auto cr1_out{context.GetHeap<CodeRange>(cr1_out_ptr)};
+            const auto cr2_out{context.GetHeap<CodeRange>(cr2_out_ptr)};
+
+            IPC::ResponseBuilder rb{ctx, 8};
+            rb.Push(ResultSuccess);
+            rb.Push<u64>(return_value);
+            rb.PushRaw(cr1_out);
+            rb.PushRaw(cr2_out);
+        } else {
+            LOG_WARNING(Service_JIT, "plugin GenerateCode callback failed");
+            IPC::ResponseBuilder rb{ctx, 2};
+            rb.Push(ResultUnknown);
+        }
+    };
+
+    void Control(Kernel::HLERequestContext& ctx) {
+        IPC::RequestParser rp{ctx};
+        const auto command{rp.PopRaw<u64>()};
+        const auto input_buffer{ctx.ReadBuffer()};
+        std::vector<u8> output_buffer(ctx.CanWriteBuffer() ? ctx.GetWriteBufferSize() : 0);
+
+        const VAddr return_ptr{context.AddHeap(0u)};
+        const VAddr configuration_ptr{context.AddHeap(configuration)};
+        const VAddr input_ptr{context.AddHeap(input_buffer.data(), input_buffer.size())};
+        const VAddr output_ptr{context.AddHeap(output_buffer.data(), output_buffer.size())};
+        const u64 wrapper_value{
+            context.CallFunction(callbacks.Control, return_ptr, configuration_ptr, command,
+                                 input_ptr, input_buffer.size(), output_ptr, output_buffer.size())};
+        const s32 return_value{context.GetHeap<s32>(return_ptr)};
+
+        if (wrapper_value == 0 && return_value == 0) {
+            if (ctx.CanWriteBuffer()) {
+                context.GetHeap(output_ptr, output_buffer.data(), output_buffer.size());
+                ctx.WriteBuffer(output_buffer.data(), output_buffer.size());
+            }
+            IPC::ResponseBuilder rb{ctx, 3};
+            rb.Push(ResultSuccess);
+            rb.Push(return_value);
+        } else {
+            LOG_WARNING(Service_JIT, "plugin Control callback failed");
+            IPC::ResponseBuilder rb{ctx, 2};
+            rb.Push(ResultUnknown);
+        }
+    }
+
+    void LoadPlugin(Kernel::HLERequestContext& ctx) {
+        IPC::RequestParser rp{ctx};
+        const auto tmem_size{rp.PopRaw<u64>()};
+        if (tmem_size == 0) {
+            LOG_ERROR(Service_JIT, "attempted to load plugin with empty transfer memory");
+            IPC::ResponseBuilder rb{ctx, 2};
+            rb.Push(ResultUnknown);
+            return;
+        }
+
+        const auto tmem_handle{ctx.GetCopyHandle(0)};
+        auto tmem{system.CurrentProcess()->GetHandleTable().GetObject<Kernel::KTransferMemory>(
+            tmem_handle)};
+        if (tmem.IsNull()) {
+            LOG_ERROR(Service_JIT, "attempted to load plugin with invalid transfer memory handle");
+            IPC::ResponseBuilder rb{ctx, 2};
+            rb.Push(ResultUnknown);
+            return;
+        }
+
+        configuration.work_memory.offset = tmem->GetSourceAddress();
+        configuration.work_memory.size = tmem_size;
+
+        const auto nro_plugin{ctx.ReadBuffer(1)};
+        auto symbols{Core::Symbols::GetSymbols(nro_plugin, true)};
+        const auto GetSymbol{[&](std::string name) { return symbols[name].first; }};
+
+        callbacks =
+            GuestCallbacks{.rtld_fini = GetSymbol("_fini"),
+                           .rtld_init = GetSymbol("_init"),
+                           .Control = GetSymbol("nnjitpluginControl"),
+                           .ResolveBasicSymbols = GetSymbol("nnjitpluginResolveBasicSymbols"),
+                           .SetupDiagnostics = GetSymbol("nnjitpluginSetupDiagnostics"),
+                           .Configure = GetSymbol("nnjitpluginConfigure"),
+                           .GenerateCode = GetSymbol("nnjitpluginGenerateCode"),
+                           .GetVersion = GetSymbol("nnjitpluginGetVersion"),
+                           .Keeper = GetSymbol("nnjitpluginKeeper"),
+                           .OnPrepared = GetSymbol("nnjitpluginOnPrepared")};
+
+        if (callbacks.GetVersion == 0 || callbacks.Configure == 0 || callbacks.GenerateCode == 0 ||
+            callbacks.OnPrepared == 0) {
+            LOG_ERROR(Service_JIT, "plugin does not implement all necessary functionality");
+            IPC::ResponseBuilder rb{ctx, 2};
+            rb.Push(ResultUnknown);
+            return;
+        }
+
+        if (!context.LoadNRO(nro_plugin)) {
+            LOG_ERROR(Service_JIT, "failed to load plugin");
+            IPC::ResponseBuilder rb{ctx, 2};
+            rb.Push(ResultUnknown);
+            return;
+        }
+
+        context.MapProcessMemory(configuration.sys_ro_memory.offset,
+                                 configuration.sys_ro_memory.size);
+        context.MapProcessMemory(configuration.sys_rx_memory.offset,
+                                 configuration.sys_rx_memory.size);
+        context.MapProcessMemory(configuration.work_memory.offset, configuration.work_memory.size);
+
+        if (callbacks.rtld_init != 0) {
+            context.CallFunction(callbacks.rtld_init);
+        }
+
+        const auto version{context.CallFunction(callbacks.GetVersion)};
+        if (version != 1) {
+            LOG_ERROR(Service_JIT, "unknown plugin version {}", version);
+            IPC::ResponseBuilder rb{ctx, 2};
+            rb.Push(ResultUnknown);
+            return;
+        }
+
+        const auto resolve{context.GetHelper("_resolve")};
+        if (callbacks.ResolveBasicSymbols != 0) {
+            context.CallFunction(callbacks.ResolveBasicSymbols, resolve);
+        }
+        const auto resolve_ptr{context.AddHeap(resolve)};
+        if (callbacks.SetupDiagnostics != 0) {
+            context.CallFunction(callbacks.SetupDiagnostics, 0u, resolve_ptr);
+        }
+
+        context.CallFunction(callbacks.Configure, 0u);
+        const auto configuration_ptr{context.AddHeap(configuration)};
+        context.CallFunction(callbacks.OnPrepared, configuration_ptr);
+
+        IPC::ResponseBuilder rb{ctx, 2};
+        rb.Push(ResultSuccess);
+    }
+
+    void GetCodeAddress(Kernel::HLERequestContext& ctx) {
+        IPC::ResponseBuilder rb{ctx, 6};
+        rb.Push(ResultSuccess);
+        rb.Push(configuration.user_rx_memory.offset);
+        rb.Push(configuration.user_ro_memory.offset);
+    }
+
+private:
+    using Struct32 = std::array<u8, 32>;
+
+    struct GuestCallbacks {
+        VAddr rtld_fini;
+        VAddr rtld_init;
+        VAddr Control;
+        VAddr ResolveBasicSymbols;
+        VAddr SetupDiagnostics;
+        VAddr Configure;
+        VAddr GenerateCode;
+        VAddr GetVersion;
+        VAddr Keeper;
+        VAddr OnPrepared;
+    };
+
+    struct JITConfiguration {
+        CodeRange user_rx_memory;
+        CodeRange user_ro_memory;
+        CodeRange work_memory;
+        CodeRange sys_rx_memory;
+        CodeRange sys_ro_memory;
+    };
+
+    GuestCallbacks callbacks;
+    JITConfiguration configuration;
+    JITContext context;
+};
+
+class JITU final : public ServiceFramework<JITU> {
+public:
+    explicit JITU(Core::System& system_) : ServiceFramework{system_, "jit:u"} {
+        // clang-format off
+        static const FunctionInfo functions[] = {
+            {0, &JITU::CreateJitEnvironment, "CreateJitEnvironment"},
+        };
+        // clang-format on
+
+        RegisterHandlers(functions);
+    }
+
+    void CreateJitEnvironment(Kernel::HLERequestContext& ctx) {
+        LOG_DEBUG(Service_JIT, "called");
+
+        struct Parameters {
+            u64 rx_size;
+            u64 ro_size;
+        };
+
+        IPC::RequestParser rp{ctx};
+        const auto parameters{rp.PopRaw<Parameters>()};
+        const auto executable_mem_handle{ctx.GetCopyHandle(1)};
+        const auto readable_mem_handle{ctx.GetCopyHandle(2)};
+
+        if (parameters.rx_size == 0 || parameters.ro_size == 0) {
+            LOG_ERROR(Service_JIT, "attempted to init with empty code regions");
+            IPC::ResponseBuilder rb{ctx, 2};
+            rb.Push(ResultUnknown);
+            return;
+        }
+
+        // The copy handle at index 0 is the process handle, but handle tables are
+        // per-process, so there is no point reading it here until we are multiprocess
+        const auto& process{*system.CurrentProcess()};
+
+        auto executable_mem{
+            process.GetHandleTable().GetObject<Kernel::KCodeMemory>(executable_mem_handle)};
+        if (executable_mem.IsNull()) {
+            LOG_ERROR(Service_JIT, "executable_mem is null for handle=0x{:08X}",
+                      executable_mem_handle);
+            IPC::ResponseBuilder rb{ctx, 2};
+            rb.Push(ResultUnknown);
+            return;
+        }
+
+        auto readable_mem{
+            process.GetHandleTable().GetObject<Kernel::KCodeMemory>(readable_mem_handle)};
+        if (readable_mem.IsNull()) {
+            LOG_ERROR(Service_JIT, "readable_mem is null for handle=0x{:08X}", readable_mem_handle);
+            IPC::ResponseBuilder rb{ctx, 2};
+            rb.Push(ResultUnknown);
+            return;
+        }
+
+        const CodeRange user_rx{
+            .offset = executable_mem->GetSourceAddress(),
+            .size = parameters.rx_size,
+        };
+
+        const CodeRange user_ro{
+            .offset = readable_mem->GetSourceAddress(),
+            .size = parameters.ro_size,
+        };
+
+        IPC::ResponseBuilder rb{ctx, 2, 0, 1};
+        rb.Push(ResultSuccess);
+        rb.PushIpcInterface<IJitEnvironment>(system, user_rx, user_ro);
+    }
+};
+
+void InstallInterfaces(SM::ServiceManager& sm, Core::System& system) {
+    std::make_shared<JITU>(system)->InstallAsService(sm);
+}
+
+} // namespace Service::JIT
diff --git a/src/core/hle/service/jit/jit.h b/src/core/hle/service/jit/jit.h
new file mode 100644
index 000000000..8fbf504a1
--- /dev/null
+++ b/src/core/hle/service/jit/jit.h
@@ -0,0 +1,20 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#pragma once
+
+namespace Core {
+class System;
+}
+
+namespace Service::SM {
+class ServiceManager;
+}
+
+namespace Service::JIT {
+
+/// Registers all JIT services with the specified service manager.
+void InstallInterfaces(SM::ServiceManager& sm, Core::System& system);
+
+} // namespace Service::JIT
diff --git a/src/core/hle/service/jit/jit_context.cpp b/src/core/hle/service/jit/jit_context.cpp
new file mode 100644
index 000000000..630368fb3
--- /dev/null
+++ b/src/core/hle/service/jit/jit_context.cpp
@@ -0,0 +1,424 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#include <array>
+#include <map>
+#include <span>
+#include <boost/icl/interval_set.hpp>
+#include <dynarmic/interface/A64/a64.h>
+#include <dynarmic/interface/A64/config.h>
+
+#include "common/alignment.h"
+#include "common/common_funcs.h"
+#include "common/div_ceil.h"
+#include "common/logging/log.h"
+#include "core/hle/service/jit/jit_context.h"
+#include "core/memory.h"
+
+namespace Service::JIT {
+
+constexpr std::array<u8, 4> STOP_ARM64 = {
+    0x01, 0x00, 0x00, 0xd4, // svc  #0
+};
+
+constexpr std::array<u8, 8> RESOLVE_ARM64 = {
+    0x21, 0x00, 0x00, 0xd4, // svc  #1
+    0xc0, 0x03, 0x5f, 0xd6, // ret
+};
+
+constexpr std::array<u8, 4> PANIC_ARM64 = {
+    0x41, 0x00, 0x00, 0xd4, // svc  #2
+};
+
+constexpr std::array<u8, 60> MEMMOVE_ARM64 = {
+    0x1f, 0x00, 0x01, 0xeb, // cmp  x0, x1
+    0x83, 0x01, 0x00, 0x54, // b.lo #+34
+    0x42, 0x04, 0x00, 0xd1, // sub  x2, x2, 1
+    0x22, 0x01, 0xf8, 0xb7, // tbnz x2, #63, #+36
+    0x23, 0x68, 0x62, 0x38, // ldrb w3, [x1, x2]
+    0x03, 0x68, 0x22, 0x38, // strb w3, [x0, x2]
+    0xfc, 0xff, 0xff, 0x17, // b    #-16
+    0x24, 0x68, 0x63, 0x38, // ldrb w4, [x1, x3]
+    0x04, 0x68, 0x23, 0x38, // strb w4, [x0, x3]
+    0x63, 0x04, 0x00, 0x91, // add  x3, x3, 1
+    0x7f, 0x00, 0x02, 0xeb, // cmp  x3, x2
+    0x8b, 0xff, 0xff, 0x54, // b.lt #-16
+    0xc0, 0x03, 0x5f, 0xd6, // ret
+    0x03, 0x00, 0x80, 0xd2, // mov  x3, 0
+    0xfc, 0xff, 0xff, 0x17, // b    #-16
+};
+
+constexpr std::array<u8, 28> MEMSET_ARM64 = {
+    0x03, 0x00, 0x80, 0xd2, // mov  x3, 0
+    0x7f, 0x00, 0x02, 0xeb, // cmp  x3, x2
+    0x4b, 0x00, 0x00, 0x54, // b.lt #+8
+    0xc0, 0x03, 0x5f, 0xd6, // ret
+    0x01, 0x68, 0x23, 0x38, // strb w1, [x0, x3]
+    0x63, 0x04, 0x00, 0x91, // add  x3, x3, 1
+    0xfb, 0xff, 0xff, 0x17, // b    #-20
+};
+
+struct HelperFunction {
+    const char* name;
+    const std::span<const u8> data;
+};
+
+constexpr std::array<HelperFunction, 6> HELPER_FUNCTIONS{{
+    {"_stop", STOP_ARM64},
+    {"_resolve", RESOLVE_ARM64},
+    {"_panic", PANIC_ARM64},
+    {"memcpy", MEMMOVE_ARM64},
+    {"memmove", MEMMOVE_ARM64},
+    {"memset", MEMSET_ARM64},
+}};
+
+struct Elf64_Dyn {
+    u64 d_tag;
+    u64 d_un;
+};
+
+struct Elf64_Rela {
+    u64 r_offset;
+    u64 r_info;
+    s64 r_addend;
+};
+
+static constexpr u32 Elf64_RelaType(const Elf64_Rela* rela) {
+    return static_cast<u32>(rela->r_info);
+}
+
+constexpr int DT_RELA = 7;               /* Address of Rela relocs */
+constexpr int DT_RELASZ = 8;             /* Total size of Rela relocs */
+constexpr int R_AARCH64_RELATIVE = 1027; /* Adjust by program base.  */
+
+constexpr size_t STACK_ALIGN = 16;
+
+class JITContextImpl;
+
+using IntervalSet = boost::icl::interval_set<VAddr>::type;
+using IntervalType = boost::icl::interval_set<VAddr>::interval_type;
+
+class DynarmicCallbacks64 : public Dynarmic::A64::UserCallbacks {
+public:
+    explicit DynarmicCallbacks64(Core::Memory::Memory& memory_, std::vector<u8>& local_memory_,
+                                 IntervalSet& mapped_ranges_, JITContextImpl& parent_)
+        : memory{memory_}, local_memory{local_memory_},
+          mapped_ranges{mapped_ranges_}, parent{parent_} {}
+
+    u8 MemoryRead8(u64 vaddr) override {
+        return ReadMemory<u8>(vaddr);
+    }
+    u16 MemoryRead16(u64 vaddr) override {
+        return ReadMemory<u16>(vaddr);
+    }
+    u32 MemoryRead32(u64 vaddr) override {
+        return ReadMemory<u32>(vaddr);
+    }
+    u64 MemoryRead64(u64 vaddr) override {
+        return ReadMemory<u64>(vaddr);
+    }
+    u128 MemoryRead128(u64 vaddr) override {
+        return ReadMemory<u128>(vaddr);
+    }
+    std::string MemoryReadCString(u64 vaddr) {
+        std::string result;
+        u8 next;
+
+        while ((next = MemoryRead8(vaddr++)) != 0) {
+            result += next;
+        }
+
+        return result;
+    }
+
+    void MemoryWrite8(u64 vaddr, u8 value) override {
+        WriteMemory<u8>(vaddr, value);
+    }
+    void MemoryWrite16(u64 vaddr, u16 value) override {
+        WriteMemory<u16>(vaddr, value);
+    }
+    void MemoryWrite32(u64 vaddr, u32 value) override {
+        WriteMemory<u32>(vaddr, value);
+    }
+    void MemoryWrite64(u64 vaddr, u64 value) override {
+        WriteMemory<u64>(vaddr, value);
+    }
+    void MemoryWrite128(u64 vaddr, u128 value) override {
+        WriteMemory<u128>(vaddr, value);
+    }
+
+    bool MemoryWriteExclusive8(u64 vaddr, u8 value, u8) override {
+        return WriteMemory<u8>(vaddr, value);
+    }
+    bool MemoryWriteExclusive16(u64 vaddr, u16 value, u16) override {
+        return WriteMemory<u16>(vaddr, value);
+    }
+    bool MemoryWriteExclusive32(u64 vaddr, u32 value, u32) override {
+        return WriteMemory<u32>(vaddr, value);
+    }
+    bool MemoryWriteExclusive64(u64 vaddr, u64 value, u64) override {
+        return WriteMemory<u64>(vaddr, value);
+    }
+    bool MemoryWriteExclusive128(u64 vaddr, u128 value, u128) override {
+        return WriteMemory<u128>(vaddr, value);
+    }
+
+    void CallSVC(u32 swi) override;
+    void ExceptionRaised(u64 pc, Dynarmic::A64::Exception exception) override;
+    void InterpreterFallback(u64 pc, size_t num_instructions) override;
+
+    void AddTicks(u64 ticks) override {}
+    u64 GetTicksRemaining() override {
+        return std::numeric_limits<u32>::max();
+    }
+    u64 GetCNTPCT() override {
+        return 0;
+    }
+
+    template <class T>
+    T ReadMemory(u64 vaddr) {
+        T ret{};
+        if (boost::icl::contains(mapped_ranges, vaddr)) {
+            memory.ReadBlock(vaddr, &ret, sizeof(T));
+        } else if (vaddr + sizeof(T) > local_memory.size()) {
+            LOG_CRITICAL(Service_JIT, "plugin: unmapped read @ 0x{:016x}", vaddr);
+        } else {
+            std::memcpy(&ret, local_memory.data() + vaddr, sizeof(T));
+        }
+        return ret;
+    }
+
+    template <class T>
+    bool WriteMemory(u64 vaddr, const T value) {
+        if (boost::icl::contains(mapped_ranges, vaddr)) {
+            memory.WriteBlock(vaddr, &value, sizeof(T));
+        } else if (vaddr + sizeof(T) > local_memory.size()) {
+            LOG_CRITICAL(Service_JIT, "plugin: unmapped write @ 0x{:016x}", vaddr);
+        } else {
+            std::memcpy(local_memory.data() + vaddr, &value, sizeof(T));
+        }
+        return true;
+    }
+
+private:
+    Core::Memory::Memory& memory;
+    std::vector<u8>& local_memory;
+    IntervalSet& mapped_ranges;
+    JITContextImpl& parent;
+};
+
+class JITContextImpl {
+public:
+    explicit JITContextImpl(Core::Memory::Memory& memory_) : memory{memory_} {
+        callbacks =
+            std::make_unique<DynarmicCallbacks64>(memory, local_memory, mapped_ranges, *this);
+        user_config.callbacks = callbacks.get();
+        jit = std::make_unique<Dynarmic::A64::Jit>(user_config);
+    }
+
+    bool LoadNRO(std::span<const u8> data) {
+        local_memory.clear();
+        local_memory.insert(local_memory.end(), data.begin(), data.end());
+
+        if (FixupRelocations()) {
+            InsertHelperFunctions();
+            InsertStack();
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+    bool FixupRelocations() {
+        const VAddr mod_offset{callbacks->MemoryRead32(4)};
+        if (callbacks->MemoryRead32(mod_offset) != Common::MakeMagic('M', 'O', 'D', '0')) {
+            return false;
+        }
+
+        VAddr dynamic_offset{mod_offset + callbacks->MemoryRead32(mod_offset + 4)};
+        VAddr rela_dyn = 0;
+        size_t num_rela = 0;
+        while (true) {
+            const auto dyn{callbacks->ReadMemory<Elf64_Dyn>(dynamic_offset)};
+            dynamic_offset += sizeof(Elf64_Dyn);
+
+            if (!dyn.d_tag) {
+                break;
+            }
+            if (dyn.d_tag == DT_RELA) {
+                rela_dyn = dyn.d_un;
+            }
+            if (dyn.d_tag == DT_RELASZ) {
+                num_rela = dyn.d_un / sizeof(Elf64_Rela);
+            }
+        }
+
+        for (size_t i = 0; i < num_rela; i++) {
+            const auto rela{callbacks->ReadMemory<Elf64_Rela>(rela_dyn + i * sizeof(Elf64_Rela))};
+            if (Elf64_RelaType(&rela) != R_AARCH64_RELATIVE) {
+                continue;
+            }
+            const VAddr contents{callbacks->MemoryRead64(rela.r_offset)};
+            callbacks->MemoryWrite64(rela.r_offset, contents + rela.r_addend);
+        }
+
+        return true;
+    }
+
+    void InsertHelperFunctions() {
+        for (const auto& [name, contents] : HELPER_FUNCTIONS) {
+            helpers[name] = local_memory.size();
+            local_memory.insert(local_memory.end(), contents.begin(), contents.end());
+        }
+    }
+
+    void InsertStack() {
+        const u64 pad_amount{Common::AlignUp(local_memory.size(), STACK_ALIGN) -
+                             local_memory.size()};
+        local_memory.insert(local_memory.end(), 0x10000 + pad_amount, 0);
+        top_of_stack = local_memory.size();
+        heap_pointer = top_of_stack;
+    }
+
+    void MapProcessMemory(VAddr dest_address, std::size_t size) {
+        mapped_ranges.add(IntervalType{dest_address, dest_address + size});
+    }
+
+    void PushArgument(const void* data, size_t size) {
+        const size_t num_words = Common::DivCeil(size, sizeof(u64));
+        const size_t current_pos = argument_stack.size();
+        argument_stack.insert(argument_stack.end(), num_words, 0);
+        std::memcpy(argument_stack.data() + current_pos, data, size);
+    }
+
+    void SetupArguments() {
+        for (size_t i = 0; i < 8 && i < argument_stack.size(); i++) {
+            jit->SetRegister(i, argument_stack[i]);
+        }
+        if (argument_stack.size() > 8) {
+            const VAddr new_sp = Common::AlignDown(
+                top_of_stack - (argument_stack.size() - 8) * sizeof(u64), STACK_ALIGN);
+            for (size_t i = 8; i < argument_stack.size(); i++) {
+                callbacks->MemoryWrite64(new_sp + (i - 8) * sizeof(u64), argument_stack[i]);
+            }
+            jit->SetSP(new_sp);
+        }
+        argument_stack.clear();
+        heap_pointer = top_of_stack;
+    }
+
+    u64 CallFunction(VAddr func) {
+        jit->SetRegister(30, helpers["_stop"]);
+        jit->SetSP(top_of_stack);
+        SetupArguments();
+
+        jit->SetPC(func);
+        jit->Run();
+        return jit->GetRegister(0);
+    }
+
+    VAddr GetHelper(const std::string& name) {
+        return helpers[name];
+    }
+
+    VAddr AddHeap(const void* data, size_t size) {
+        const size_t num_bytes{Common::AlignUp(size, STACK_ALIGN)};
+        if (heap_pointer + num_bytes > local_memory.size()) {
+            local_memory.insert(local_memory.end(),
+                                (heap_pointer + num_bytes) - local_memory.size(), 0);
+        }
+        const VAddr location{heap_pointer};
+        std::memcpy(local_memory.data() + location, data, size);
+        heap_pointer += num_bytes;
+        return location;
+    }
+
+    void GetHeap(VAddr location, void* data, size_t size) {
+        std::memcpy(data, local_memory.data() + location, size);
+    }
+
+    std::unique_ptr<DynarmicCallbacks64> callbacks;
+    std::vector<u8> local_memory;
+    std::vector<u64> argument_stack;
+    IntervalSet mapped_ranges;
+    Dynarmic::A64::UserConfig user_config;
+    std::unique_ptr<Dynarmic::A64::Jit> jit;
+    std::map<std::string, VAddr, std::less<>> helpers;
+    Core::Memory::Memory& memory;
+    VAddr top_of_stack;
+    VAddr heap_pointer;
+};
+
+void DynarmicCallbacks64::CallSVC(u32 swi) {
+    switch (swi) {
+    case 0:
+        parent.jit->HaltExecution();
+        break;
+
+    case 1: {
+        // X0 contains a char* for a symbol to resolve
+        std::string name{MemoryReadCString(parent.jit->GetRegister(0))};
+        const auto helper{parent.helpers[name]};
+
+        if (helper != 0) {
+            parent.jit->SetRegister(0, helper);
+        } else {
+            LOG_WARNING(Service_JIT, "plugin requested unknown function {}", name);
+            parent.jit->SetRegister(0, parent.helpers["_panic"]);
+        }
+        break;
+    }
+
+    case 2:
+    default:
+        LOG_CRITICAL(Service_JIT, "plugin panicked!");
+        parent.jit->HaltExecution();
+        break;
+    }
+}
+
+void DynarmicCallbacks64::ExceptionRaised(u64 pc, Dynarmic::A64::Exception exception) {
+    LOG_CRITICAL(Service_JIT, "Illegal operation PC @ {:08x}", pc);
+    parent.jit->HaltExecution();
+}
+
+void DynarmicCallbacks64::InterpreterFallback(u64 pc, size_t num_instructions) {
+    LOG_CRITICAL(Service_JIT, "Unimplemented instruction PC @ {:08x}", pc);
+    parent.jit->HaltExecution();
+}
+
+JITContext::JITContext(Core::Memory::Memory& memory)
+    : impl{std::make_unique<JITContextImpl>(memory)} {}
+
+JITContext::~JITContext() {}
+
+bool JITContext::LoadNRO(std::span<const u8> data) {
+    return impl->LoadNRO(data);
+}
+
+void JITContext::MapProcessMemory(VAddr dest_address, std::size_t size) {
+    impl->MapProcessMemory(dest_address, size);
+}
+
+u64 JITContext::CallFunction(VAddr func) {
+    return impl->CallFunction(func);
+}
+
+void JITContext::PushArgument(const void* data, size_t size) {
+    impl->PushArgument(data, size);
+}
+
+VAddr JITContext::GetHelper(const std::string& name) {
+    return impl->GetHelper(name);
+}
+
+VAddr JITContext::AddHeap(const void* data, size_t size) {
+    return impl->AddHeap(data, size);
+}
+
+void JITContext::GetHeap(VAddr location, void* data, size_t size) {
+    impl->GetHeap(location, data, size);
+}
+
+} // namespace Service::JIT
diff --git a/src/core/hle/service/jit/jit_context.h b/src/core/hle/service/jit/jit_context.h
new file mode 100644
index 000000000..d8bf76cff
--- /dev/null
+++ b/src/core/hle/service/jit/jit_context.h
@@ -0,0 +1,65 @@
+// Copyright 2022 yuzu Emulator Project
+// Licensed under GPLv2 or any later version
+// Refer to the license.txt file included.
+
+#pragma once
+
+#include <memory>
+#include <span>
+#include <string>
+
+#include "common/common_types.h"
+
+namespace Core::Memory {
+class Memory;
+}
+
+namespace Service::JIT {
+
+class JITContextImpl;
+
+class JITContext {
+public:
+    explicit JITContext(Core::Memory::Memory& memory);
+    ~JITContext();
+
+    [[nodiscard]] bool LoadNRO(std::span<const u8> data);
+    void MapProcessMemory(VAddr dest_address, std::size_t size);
+
+    template <typename T, typename... Ts>
+    u64 CallFunction(VAddr func, T argument, Ts... rest) {
+        static_assert(std::is_trivially_copyable_v<T>);
+        PushArgument(&argument, sizeof(argument));
+
+        if constexpr (sizeof...(rest) > 0) {
+            return CallFunction(func, rest...);
+        } else {
+            return CallFunction(func);
+        }
+    }
+
+    u64 CallFunction(VAddr func);
+    VAddr GetHelper(const std::string& name);
+
+    template <typename T>
+    VAddr AddHeap(T argument) {
+        return AddHeap(&argument, sizeof(argument));
+    }
+    VAddr AddHeap(const void* data, size_t size);
+
+    template <typename T>
+    T GetHeap(VAddr location) {
+        static_assert(std::is_trivially_copyable_v<T>);
+        T result;
+        GetHeap(location, &result, sizeof(result));
+        return result;
+    }
+    void GetHeap(VAddr location, void* data, size_t size);
+
+private:
+    std::unique_ptr<JITContextImpl> impl;
+
+    void PushArgument(const void* data, size_t size);
+};
+
+} // namespace Service::JIT
diff --git a/src/core/hle/service/kernel_helpers.cpp b/src/core/hle/service/kernel_helpers.cpp
index b8c2c6e51..ff0bbb788 100644
--- a/src/core/hle/service/kernel_helpers.cpp
+++ b/src/core/hle/service/kernel_helpers.cpp
@@ -17,21 +17,12 @@ namespace Service::KernelHelpers {
 
 ServiceContext::ServiceContext(Core::System& system_, std::string name_)
     : kernel(system_.Kernel()) {
-
-    // Create a resource limit for the process.
-    const auto physical_memory_size =
-        kernel.MemoryManager().GetSize(Kernel::KMemoryManager::Pool::System);
-    auto* resource_limit = Kernel::CreateResourceLimitForProcess(system_, physical_memory_size);
-
     // Create the process.
     process = Kernel::KProcess::Create(kernel);
     ASSERT(Kernel::KProcess::Initialize(process, system_, std::move(name_),
                                         Kernel::KProcess::ProcessType::KernelInternal,
-                                        resource_limit)
+                                        kernel.GetSystemResourceLimit())
                .IsSuccess());
-
-    // Close reference to our resource limit, as the process opens one.
-    resource_limit->Close();
 }
 
 ServiceContext::~ServiceContext() {
diff --git a/src/core/hle/service/ldr/ldr.cpp b/src/core/hle/service/ldr/ldr.cpp
index 099276420..cf727c167 100644
--- a/src/core/hle/service/ldr/ldr.cpp
+++ b/src/core/hle/service/ldr/ldr.cpp
@@ -12,7 +12,6 @@
 #include "core/core.h"
 #include "core/hle/ipc_helpers.h"
 #include "core/hle/kernel/k_page_table.h"
-#include "core/hle/kernel/k_system_control.h"
 #include "core/hle/kernel/svc_results.h"
 #include "core/hle/kernel/svc_types.h"
 #include "core/hle/service/ldr/ldr.h"
@@ -390,8 +389,12 @@ public:
 
             if (bss_size) {
                 auto block_guard = detail::ScopeExit([&] {
-                    page_table.UnmapCodeMemory(addr + nro_size, bss_addr, bss_size);
-                    page_table.UnmapCodeMemory(addr, nro_addr, nro_size);
+                    page_table.UnmapCodeMemory(
+                        addr + nro_size, bss_addr, bss_size,
+                        Kernel::KPageTable::ICacheInvalidationStrategy::InvalidateRange);
+                    page_table.UnmapCodeMemory(
+                        addr, nro_addr, nro_size,
+                        Kernel::KPageTable::ICacheInvalidationStrategy::InvalidateRange);
                 });
 
                 const ResultCode result{
@@ -571,17 +574,21 @@ public:
         auto& page_table{system.CurrentProcess()->PageTable()};
 
         if (info.bss_size != 0) {
-            CASCADE_CODE(page_table.UnmapCodeMemory(info.nro_address + info.text_size +
-                                                        info.ro_size + info.data_size,
-                                                    info.bss_address, info.bss_size));
+            CASCADE_CODE(page_table.UnmapCodeMemory(
+                info.nro_address + info.text_size + info.ro_size + info.data_size, info.bss_address,
+                info.bss_size, Kernel::KPageTable::ICacheInvalidationStrategy::InvalidateRange));
         }
 
-        CASCADE_CODE(page_table.UnmapCodeMemory(info.nro_address + info.text_size + info.ro_size,
-                                                info.src_addr + info.text_size + info.ro_size,
-                                                info.data_size));
-        CASCADE_CODE(page_table.UnmapCodeMemory(info.nro_address + info.text_size,
-                                                info.src_addr + info.text_size, info.ro_size));
-        CASCADE_CODE(page_table.UnmapCodeMemory(info.nro_address, info.src_addr, info.text_size));
+        CASCADE_CODE(page_table.UnmapCodeMemory(
+            info.nro_address + info.text_size + info.ro_size,
+            info.src_addr + info.text_size + info.ro_size, info.data_size,
+            Kernel::KPageTable::ICacheInvalidationStrategy::InvalidateRange));
+        CASCADE_CODE(page_table.UnmapCodeMemory(
+            info.nro_address + info.text_size, info.src_addr + info.text_size, info.ro_size,
+            Kernel::KPageTable::ICacheInvalidationStrategy::InvalidateRange));
+        CASCADE_CODE(page_table.UnmapCodeMemory(
+            info.nro_address, info.src_addr, info.text_size,
+            Kernel::KPageTable::ICacheInvalidationStrategy::InvalidateRange));
         return ResultSuccess;
     }
 
diff --git a/src/core/hle/service/mii/mii_manager.cpp b/src/core/hle/service/mii/mii_manager.cpp
index 0a57c3cde..188231615 100644
--- a/src/core/hle/service/mii/mii_manager.cpp
+++ b/src/core/hle/service/mii/mii_manager.cpp
@@ -1,4 +1,4 @@
-// Copyright 2020 yuzu emulator team
+// Copyright 2020 yuzu Emulator Project
 // Licensed under GPLv2 or any later version
 // Refer to the license.txt file included.
 
@@ -12,7 +12,6 @@
 #include "core/hle/service/acc/profile_manager.h"
 #include "core/hle/service/mii/mii_manager.h"
 #include "core/hle/service/mii/raw_data.h"
-#include "core/hle/service/mii/types.h"
 
 namespace Service::Mii {
 
diff --git a/src/core/hle/service/mii/mii_manager.h b/src/core/hle/service/mii/mii_manager.h
index 6999d15b1..5d134c425 100644
--- a/src/core/hle/service/mii/mii_manager.h
+++ b/src/core/hle/service/mii/mii_manager.h
@@ -1,315 +1,16 @@
-// Copyright 2020 yuzu emulator team
+// Copyright 2020 yuzu Emulator Project
 // Licensed under GPLv2 or any later version
 // Refer to the license.txt file included.
 
 #pragma once
 
-#include <array>
 #include <vector>
-#include "common/bit_field.h"
-#include "common/common_funcs.h"
-#include "common/uuid.h"
+
 #include "core/hle/result.h"
 #include "core/hle/service/mii/types.h"
 
 namespace Service::Mii {
 
-enum class Source : u32 {
-    Database = 0,
-    Default = 1,
-    Account = 2,
-    Friend = 3,
-};
-
-enum class SourceFlag : u32 {
-    None = 0,
-    Database = 1 << 0,
-    Default = 1 << 1,
-};
-DECLARE_ENUM_FLAG_OPERATORS(SourceFlag);
-
-struct MiiInfo {
-    Common::UUID uuid;
-    std::array<char16_t, 11> name;
-    u8 font_region;
-    u8 favorite_color;
-    u8 gender;
-    u8 height;
-    u8 build;
-    u8 type;
-    u8 region_move;
-    u8 faceline_type;
-    u8 faceline_color;
-    u8 faceline_wrinkle;
-    u8 faceline_make;
-    u8 hair_type;
-    u8 hair_color;
-    u8 hair_flip;
-    u8 eye_type;
-    u8 eye_color;
-    u8 eye_scale;
-    u8 eye_aspect;
-    u8 eye_rotate;
-    u8 eye_x;
-    u8 eye_y;
-    u8 eyebrow_type;
-    u8 eyebrow_color;
-    u8 eyebrow_scale;
-    u8 eyebrow_aspect;
-    u8 eyebrow_rotate;
-    u8 eyebrow_x;
-    u8 eyebrow_y;
-    u8 nose_type;
-    u8 nose_scale;
-    u8 nose_y;
-    u8 mouth_type;
-    u8 mouth_color;
-    u8 mouth_scale;
-    u8 mouth_aspect;
-    u8 mouth_y;
-    u8 beard_color;
-    u8 beard_type;
-    u8 mustache_type;
-    u8 mustache_scale;
-    u8 mustache_y;
-    u8 glasses_type;
-    u8 glasses_color;
-    u8 glasses_scale;
-    u8 glasses_y;
-    u8 mole_type;
-    u8 mole_scale;
-    u8 mole_x;
-    u8 mole_y;
-    u8 padding;
-
-    std::u16string Name() const;
-};
-static_assert(sizeof(MiiInfo) == 0x58, "MiiInfo has incorrect size.");
-static_assert(std::has_unique_object_representations_v<MiiInfo>,
-              "All bits of MiiInfo must contribute to its value.");
-
-#pragma pack(push, 4)
-
-struct MiiInfoElement {
-    MiiInfoElement(const MiiInfo& info_, Source source_) : info{info_}, source{source_} {}
-
-    MiiInfo info{};
-    Source source{};
-};
-static_assert(sizeof(MiiInfoElement) == 0x5c, "MiiInfoElement has incorrect size.");
-
-struct MiiStoreBitFields {
-    union {
-        u32 word_0{};
-
-        BitField<0, 8, u32> hair_type;
-        BitField<8, 7, u32> height;
-        BitField<15, 1, u32> mole_type;
-        BitField<16, 7, u32> build;
-        BitField<23, 1, HairFlip> hair_flip;
-        BitField<24, 7, u32> hair_color;
-        BitField<31, 1, u32> type;
-    };
-
-    union {
-        u32 word_1{};
-
-        BitField<0, 7, u32> eye_color;
-        BitField<7, 1, Gender> gender;
-        BitField<8, 7, u32> eyebrow_color;
-        BitField<16, 7, u32> mouth_color;
-        BitField<24, 7, u32> beard_color;
-    };
-
-    union {
-        u32 word_2{};
-
-        BitField<0, 7, u32> glasses_color;
-        BitField<8, 6, u32> eye_type;
-        BitField<14, 2, u32> region_move;
-        BitField<16, 6, u32> mouth_type;
-        BitField<22, 2, FontRegion> font_region;
-        BitField<24, 5, u32> eye_y;
-        BitField<29, 3, u32> glasses_scale;
-    };
-
-    union {
-        u32 word_3{};
-
-        BitField<0, 5, u32> eyebrow_type;
-        BitField<5, 3, MustacheType> mustache_type;
-        BitField<8, 5, u32> nose_type;
-        BitField<13, 3, BeardType> beard_type;
-        BitField<16, 5, u32> nose_y;
-        BitField<21, 3, u32> mouth_aspect;
-        BitField<24, 5, u32> mouth_y;
-        BitField<29, 3, u32> eyebrow_aspect;
-    };
-
-    union {
-        u32 word_4{};
-
-        BitField<0, 5, u32> mustache_y;
-        BitField<5, 3, u32> eye_rotate;
-        BitField<8, 5, u32> glasses_y;
-        BitField<13, 3, u32> eye_aspect;
-        BitField<16, 5, u32> mole_x;
-        BitField<21, 3, u32> eye_scale;
-        BitField<24, 5, u32> mole_y;
-    };
-
-    union {
-        u32 word_5{};
-
-        BitField<0, 5, u32> glasses_type;
-        BitField<8, 4, u32> favorite_color;
-        BitField<12, 4, u32> faceline_type;
-        BitField<16, 4, u32> faceline_color;
-        BitField<20, 4, u32> faceline_wrinkle;
-        BitField<24, 4, u32> faceline_makeup;
-        BitField<28, 4, u32> eye_x;
-    };
-
-    union {
-        u32 word_6{};
-
-        BitField<0, 4, u32> eyebrow_scale;
-        BitField<4, 4, u32> eyebrow_rotate;
-        BitField<8, 4, u32> eyebrow_x;
-        BitField<12, 4, u32> eyebrow_y;
-        BitField<16, 4, u32> nose_scale;
-        BitField<20, 4, u32> mouth_scale;
-        BitField<24, 4, u32> mustache_scale;
-        BitField<28, 4, u32> mole_scale;
-    };
-};
-static_assert(sizeof(MiiStoreBitFields) == 0x1c, "MiiStoreBitFields has incorrect size.");
-static_assert(std::is_trivially_copyable_v<MiiStoreBitFields>,
-              "MiiStoreBitFields is not trivially copyable.");
-
-struct MiiStoreData {
-    using Name = std::array<char16_t, 10>;
-
-    MiiStoreData();
-    MiiStoreData(const Name& name, const MiiStoreBitFields& bit_fields,
-                 const Common::UUID& user_id);
-
-    // This corresponds to the above structure MiiStoreBitFields. I did it like this because the
-    // BitField<> type makes this (and any thing that contains it) not trivially copyable, which is
-    // not suitable for our uses.
-    struct {
-        std::array<u8, 0x1C> data{};
-        static_assert(sizeof(MiiStoreBitFields) == sizeof(data), "data field has incorrect size.");
-
-        Name name{};
-        Common::UUID uuid{};
-    } data;
-
-    u16 data_crc{};
-    u16 device_crc{};
-};
-static_assert(sizeof(MiiStoreData) == 0x44, "MiiStoreData has incorrect size.");
-
-struct MiiStoreDataElement {
-    MiiStoreData data{};
-    Source source{};
-};
-static_assert(sizeof(MiiStoreDataElement) == 0x48, "MiiStoreDataElement has incorrect size.");
-
-struct MiiDatabase {
-    u32 magic{}; // 'NFDB'
-    std::array<MiiStoreData, 0x64> miis{};
-    INSERT_PADDING_BYTES(1);
-    u8 count{};
-    u16 crc{};
-};
-static_assert(sizeof(MiiDatabase) == 0x1A98, "MiiDatabase has incorrect size.");
-
-struct RandomMiiValues {
-    std::array<u8, 0xbc> values{};
-};
-static_assert(sizeof(RandomMiiValues) == 0xbc, "RandomMiiValues has incorrect size.");
-
-struct RandomMiiData4 {
-    Gender gender{};
-    Age age{};
-    Race race{};
-    u32 values_count{};
-    std::array<u32, 47> values{};
-};
-static_assert(sizeof(RandomMiiData4) == 0xcc, "RandomMiiData4 has incorrect size.");
-
-struct RandomMiiData3 {
-    u32 arg_1;
-    u32 arg_2;
-    u32 values_count;
-    std::array<u32, 47> values{};
-};
-static_assert(sizeof(RandomMiiData3) == 0xc8, "RandomMiiData3 has incorrect size.");
-
-struct RandomMiiData2 {
-    u32 arg_1;
-    u32 values_count;
-    std::array<u32, 47> values{};
-};
-static_assert(sizeof(RandomMiiData2) == 0xc4, "RandomMiiData2 has incorrect size.");
-
-struct DefaultMii {
-    u32 face_type{};
-    u32 face_color{};
-    u32 face_wrinkle{};
-    u32 face_makeup{};
-    u32 hair_type{};
-    u32 hair_color{};
-    u32 hair_flip{};
-    u32 eye_type{};
-    u32 eye_color{};
-    u32 eye_scale{};
-    u32 eye_aspect{};
-    u32 eye_rotate{};
-    u32 eye_x{};
-    u32 eye_y{};
-    u32 eyebrow_type{};
-    u32 eyebrow_color{};
-    u32 eyebrow_scale{};
-    u32 eyebrow_aspect{};
-    u32 eyebrow_rotate{};
-    u32 eyebrow_x{};
-    u32 eyebrow_y{};
-    u32 nose_type{};
-    u32 nose_scale{};
-    u32 nose_y{};
-    u32 mouth_type{};
-    u32 mouth_color{};
-    u32 mouth_scale{};
-    u32 mouth_aspect{};
-    u32 mouth_y{};
-    u32 mustache_type{};
-    u32 beard_type{};
-    u32 beard_color{};
-    u32 mustache_scale{};
-    u32 mustache_y{};
-    u32 glasses_type{};
-    u32 glasses_color{};
-    u32 glasses_scale{};
-    u32 glasses_y{};
-    u32 mole_type{};
-    u32 mole_scale{};
-    u32 mole_x{};
-    u32 mole_y{};
-    u32 height{};
-    u32 weight{};
-    Gender gender{};
-    u32 favorite_color{};
-    u32 region{};
-    FontRegion font_region{};
-    u32 type{};
-    INSERT_PADDING_WORDS(5);
-};
-static_assert(sizeof(DefaultMii) == 0xd8, "MiiStoreData has incorrect size.");
-
-#pragma pack(pop)
-
 // The Mii manager is responsible for loading and storing the Miis to the database in NAND along
 // with providing an easy interface for HLE emulation of the mii service.
 class MiiManager {
diff --git a/src/core/hle/service/mii/raw_data.h b/src/core/hle/service/mii/raw_data.h
index bd90c2162..2e39c0d4f 100644
--- a/src/core/hle/service/mii/raw_data.h
+++ b/src/core/hle/service/mii/raw_data.h
@@ -6,7 +6,7 @@
 
 #include <array>
 
-#include "core/hle/service/mii/mii_manager.h"
+#include "core/hle/service/mii/types.h"
 
 namespace Service::Mii::RawData {
 
diff --git a/src/core/hle/service/mii/types.h b/src/core/hle/service/mii/types.h
index d65a1055e..5580b8c6a 100644
--- a/src/core/hle/service/mii/types.h
+++ b/src/core/hle/service/mii/types.h
@@ -1,11 +1,16 @@
-// Copyright 2020 yuzu emulator team
+// Copyright 2020 yuzu Emulator Project
 // Licensed under GPLv2 or any later version
 // Refer to the license.txt file included.
 
 #pragma once
 
+#include <array>
+#include <type_traits>
+
+#include "common/bit_field.h"
 #include "common/common_funcs.h"
 #include "common/common_types.h"
+#include "common/uuid.h"
 
 namespace Service::Mii {
 
@@ -25,7 +30,11 @@ enum class BeardType : u32 {
     Beard5,
 };
 
-enum class BeardAndMustacheFlag : u32 { Beard = 1, Mustache, All = Beard | Mustache };
+enum class BeardAndMustacheFlag : u32 {
+    Beard = 1,
+    Mustache,
+    All = Beard | Mustache,
+};
 DECLARE_ENUM_FLAG_OPERATORS(BeardAndMustacheFlag);
 
 enum class FontRegion : u32 {
@@ -64,4 +73,298 @@ enum class Race : u32 {
     All,
 };
 
+enum class Source : u32 {
+    Database = 0,
+    Default = 1,
+    Account = 2,
+    Friend = 3,
+};
+
+enum class SourceFlag : u32 {
+    None = 0,
+    Database = 1 << 0,
+    Default = 1 << 1,
+};
+DECLARE_ENUM_FLAG_OPERATORS(SourceFlag);
+
+struct MiiInfo {
+    Common::UUID uuid;
+    std::array<char16_t, 11> name;
+    u8 font_region;
+    u8 favorite_color;
+    u8 gender;
+    u8 height;
+    u8 build;
+    u8 type;
+    u8 region_move;
+    u8 faceline_type;
+    u8 faceline_color;
+    u8 faceline_wrinkle;
+    u8 faceline_make;
+    u8 hair_type;
+    u8 hair_color;
+    u8 hair_flip;
+    u8 eye_type;
+    u8 eye_color;
+    u8 eye_scale;
+    u8 eye_aspect;
+    u8 eye_rotate;
+    u8 eye_x;
+    u8 eye_y;
+    u8 eyebrow_type;
+    u8 eyebrow_color;
+    u8 eyebrow_scale;
+    u8 eyebrow_aspect;
+    u8 eyebrow_rotate;
+    u8 eyebrow_x;
+    u8 eyebrow_y;
+    u8 nose_type;
+    u8 nose_scale;
+    u8 nose_y;
+    u8 mouth_type;
+    u8 mouth_color;
+    u8 mouth_scale;
+    u8 mouth_aspect;
+    u8 mouth_y;
+    u8 beard_color;
+    u8 beard_type;
+    u8 mustache_type;
+    u8 mustache_scale;
+    u8 mustache_y;
+    u8 glasses_type;
+    u8 glasses_color;
+    u8 glasses_scale;
+    u8 glasses_y;
+    u8 mole_type;
+    u8 mole_scale;
+    u8 mole_x;
+    u8 mole_y;
+    u8 padding;
+};
+static_assert(sizeof(MiiInfo) == 0x58, "MiiInfo has incorrect size.");
+static_assert(std::has_unique_object_representations_v<MiiInfo>,
+              "All bits of MiiInfo must contribute to its value.");
+
+#pragma pack(push, 4)
+
+struct MiiInfoElement {
+    MiiInfoElement(const MiiInfo& info_, Source source_) : info{info_}, source{source_} {}
+
+    MiiInfo info{};
+    Source source{};
+};
+static_assert(sizeof(MiiInfoElement) == 0x5c, "MiiInfoElement has incorrect size.");
+
+struct MiiStoreBitFields {
+    union {
+        u32 word_0{};
+
+        BitField<0, 8, u32> hair_type;
+        BitField<8, 7, u32> height;
+        BitField<15, 1, u32> mole_type;
+        BitField<16, 7, u32> build;
+        BitField<23, 1, HairFlip> hair_flip;
+        BitField<24, 7, u32> hair_color;
+        BitField<31, 1, u32> type;
+    };
+
+    union {
+        u32 word_1{};
+
+        BitField<0, 7, u32> eye_color;
+        BitField<7, 1, Gender> gender;
+        BitField<8, 7, u32> eyebrow_color;
+        BitField<16, 7, u32> mouth_color;
+        BitField<24, 7, u32> beard_color;
+    };
+
+    union {
+        u32 word_2{};
+
+        BitField<0, 7, u32> glasses_color;
+        BitField<8, 6, u32> eye_type;
+        BitField<14, 2, u32> region_move;
+        BitField<16, 6, u32> mouth_type;
+        BitField<22, 2, FontRegion> font_region;
+        BitField<24, 5, u32> eye_y;
+        BitField<29, 3, u32> glasses_scale;
+    };
+
+    union {
+        u32 word_3{};
+
+        BitField<0, 5, u32> eyebrow_type;
+        BitField<5, 3, MustacheType> mustache_type;
+        BitField<8, 5, u32> nose_type;
+        BitField<13, 3, BeardType> beard_type;
+        BitField<16, 5, u32> nose_y;
+        BitField<21, 3, u32> mouth_aspect;
+        BitField<24, 5, u32> mouth_y;
+        BitField<29, 3, u32> eyebrow_aspect;
+    };
+
+    union {
+        u32 word_4{};
+
+        BitField<0, 5, u32> mustache_y;
+        BitField<5, 3, u32> eye_rotate;
+        BitField<8, 5, u32> glasses_y;
+        BitField<13, 3, u32> eye_aspect;
+        BitField<16, 5, u32> mole_x;
+        BitField<21, 3, u32> eye_scale;
+        BitField<24, 5, u32> mole_y;
+    };
+
+    union {
+        u32 word_5{};
+
+        BitField<0, 5, u32> glasses_type;
+        BitField<8, 4, u32> favorite_color;
+        BitField<12, 4, u32> faceline_type;
+        BitField<16, 4, u32> faceline_color;
+        BitField<20, 4, u32> faceline_wrinkle;
+        BitField<24, 4, u32> faceline_makeup;
+        BitField<28, 4, u32> eye_x;
+    };
+
+    union {
+        u32 word_6{};
+
+        BitField<0, 4, u32> eyebrow_scale;
+        BitField<4, 4, u32> eyebrow_rotate;
+        BitField<8, 4, u32> eyebrow_x;
+        BitField<12, 4, u32> eyebrow_y;
+        BitField<16, 4, u32> nose_scale;
+        BitField<20, 4, u32> mouth_scale;
+        BitField<24, 4, u32> mustache_scale;
+        BitField<28, 4, u32> mole_scale;
+    };
+};
+static_assert(sizeof(MiiStoreBitFields) == 0x1c, "MiiStoreBitFields has incorrect size.");
+static_assert(std::is_trivially_copyable_v<MiiStoreBitFields>,
+              "MiiStoreBitFields is not trivially copyable.");
+
+struct MiiStoreData {
+    using Name = std::array<char16_t, 10>;
+
+    MiiStoreData();
+    MiiStoreData(const Name& name, const MiiStoreBitFields& bit_fields,
+                 const Common::UUID& user_id);
+
+    // This corresponds to the above structure MiiStoreBitFields. I did it like this because the
+    // BitField<> type makes this (and any thing that contains it) not trivially copyable, which is
+    // not suitable for our uses.
+    struct {
+        std::array<u8, 0x1C> data{};
+        static_assert(sizeof(MiiStoreBitFields) == sizeof(data), "data field has incorrect size.");
+
+        Name name{};
+        Common::UUID uuid{};
+    } data;
+
+    u16 data_crc{};
+    u16 device_crc{};
+};
+static_assert(sizeof(MiiStoreData) == 0x44, "MiiStoreData has incorrect size.");
+
+struct MiiStoreDataElement {
+    MiiStoreData data{};
+    Source source{};
+};
+static_assert(sizeof(MiiStoreDataElement) == 0x48, "MiiStoreDataElement has incorrect size.");
+
+struct MiiDatabase {
+    u32 magic{}; // 'NFDB'
+    std::array<MiiStoreData, 0x64> miis{};
+    INSERT_PADDING_BYTES(1);
+    u8 count{};
+    u16 crc{};
+};
+static_assert(sizeof(MiiDatabase) == 0x1A98, "MiiDatabase has incorrect size.");
+
+struct RandomMiiValues {
+    std::array<u8, 0xbc> values{};
+};
+static_assert(sizeof(RandomMiiValues) == 0xbc, "RandomMiiValues has incorrect size.");
+
+struct RandomMiiData4 {
+    Gender gender{};
+    Age age{};
+    Race race{};
+    u32 values_count{};
+    std::array<u32, 47> values{};
+};
+static_assert(sizeof(RandomMiiData4) == 0xcc, "RandomMiiData4 has incorrect size.");
+
+struct RandomMiiData3 {
+    u32 arg_1;
+    u32 arg_2;
+    u32 values_count;
+    std::array<u32, 47> values{};
+};
+static_assert(sizeof(RandomMiiData3) == 0xc8, "RandomMiiData3 has incorrect size.");
+
+struct RandomMiiData2 {
+    u32 arg_1;
+    u32 values_count;
+    std::array<u32, 47> values{};
+};
+static_assert(sizeof(RandomMiiData2) == 0xc4, "RandomMiiData2 has incorrect size.");
+
+struct DefaultMii {
+    u32 face_type{};
+    u32 face_color{};
+    u32 face_wrinkle{};
+    u32 face_makeup{};
+    u32 hair_type{};
+    u32 hair_color{};
+    u32 hair_flip{};
+    u32 eye_type{};
+    u32 eye_color{};
+    u32 eye_scale{};
+    u32 eye_aspect{};
+    u32 eye_rotate{};
+    u32 eye_x{};
+    u32 eye_y{};
+    u32 eyebrow_type{};
+    u32 eyebrow_color{};
+    u32 eyebrow_scale{};
+    u32 eyebrow_aspect{};
+    u32 eyebrow_rotate{};
+    u32 eyebrow_x{};
+    u32 eyebrow_y{};
+    u32 nose_type{};
+    u32 nose_scale{};
+    u32 nose_y{};
+    u32 mouth_type{};
+    u32 mouth_color{};
+    u32 mouth_scale{};
+    u32 mouth_aspect{};
+    u32 mouth_y{};
+    u32 mustache_type{};
+    u32 beard_type{};
+    u32 beard_color{};
+    u32 mustache_scale{};
+    u32 mustache_y{};
+    u32 glasses_type{};
+    u32 glasses_color{};
+    u32 glasses_scale{};
+    u32 glasses_y{};
+    u32 mole_type{};
+    u32 mole_scale{};
+    u32 mole_x{};
+    u32 mole_y{};
+    u32 height{};
+    u32 weight{};
+    Gender gender{};
+    u32 favorite_color{};
+    u32 region{};
+    FontRegion font_region{};
+    u32 type{};
+    INSERT_PADDING_WORDS(5);
+};
+static_assert(sizeof(DefaultMii) == 0xd8, "MiiStoreData has incorrect size.");
+
+#pragma pack(pop)
+
 } // namespace Service::Mii
diff --git a/src/core/hle/service/nfp/nfp.cpp b/src/core/hle/service/nfp/nfp.cpp
index 513107715..dab99b675 100644
--- a/src/core/hle/service/nfp/nfp.cpp
+++ b/src/core/hle/service/nfp/nfp.cpp
@@ -12,6 +12,7 @@
 #include "core/hid/hid_types.h"
 #include "core/hle/ipc_helpers.h"
 #include "core/hle/kernel/k_event.h"
+#include "core/hle/service/mii/mii_manager.h"
 #include "core/hle/service/nfp/nfp.h"
 #include "core/hle/service/nfp/nfp_user.h"
 
diff --git a/src/core/hle/service/nfp/nfp.h b/src/core/hle/service/nfp/nfp.h
index 022f13b29..ab652f635 100644
--- a/src/core/hle/service/nfp/nfp.h
+++ b/src/core/hle/service/nfp/nfp.h
@@ -9,7 +9,7 @@
 
 #include "common/common_funcs.h"
 #include "core/hle/service/kernel_helpers.h"
-#include "core/hle/service/mii/mii_manager.h"
+#include "core/hle/service/mii/types.h"
 #include "core/hle/service/service.h"
 
 namespace Kernel {
diff --git a/src/core/hle/service/nifm/nifm.cpp b/src/core/hle/service/nifm/nifm.cpp
index a253dd066..edb576ad3 100644
--- a/src/core/hle/service/nifm/nifm.cpp
+++ b/src/core/hle/service/nifm/nifm.cpp
@@ -5,7 +5,6 @@
 #include "core/core.h"
 #include "core/hle/ipc_helpers.h"
 #include "core/hle/kernel/k_event.h"
-#include "core/hle/kernel/kernel.h"
 #include "core/hle/service/kernel_helpers.h"
 #include "core/hle/service/nifm/nifm.h"
 #include "core/hle/service/service.h"
diff --git a/src/core/hle/service/ns/pdm_qry.cpp b/src/core/hle/service/ns/pdm_qry.cpp
index 36ce46353..3a83d0698 100644
--- a/src/core/hle/service/ns/pdm_qry.cpp
+++ b/src/core/hle/service/ns/pdm_qry.cpp
@@ -9,7 +9,6 @@
 #include "core/hle/ipc_helpers.h"
 #include "core/hle/service/ns/pdm_qry.h"
 #include "core/hle/service/service.h"
-#include "core/hle/service/sm/sm.h"
 
 namespace Service::NS {
 
diff --git a/src/core/hle/service/nvdrv/devices/nvdisp_disp0.cpp b/src/core/hle/service/nvdrv/devices/nvdisp_disp0.cpp
index 68f1e9060..9fad45fe1 100644
--- a/src/core/hle/service/nvdrv/devices/nvdisp_disp0.cpp
+++ b/src/core/hle/service/nvdrv/devices/nvdisp_disp0.cpp
@@ -38,18 +38,16 @@ NvResult nvdisp_disp0::Ioctl3(DeviceFD fd, Ioctl command, const std::vector<u8>&
 void nvdisp_disp0::OnOpen(DeviceFD fd) {}
 void nvdisp_disp0::OnClose(DeviceFD fd) {}
 
-void nvdisp_disp0::flip(u32 buffer_handle, u32 offset, u32 format, u32 width, u32 height,
-                        u32 stride, NVFlinger::BufferQueue::BufferTransformFlags transform,
+void nvdisp_disp0::flip(u32 buffer_handle, u32 offset, android::PixelFormat format, u32 width,
+                        u32 height, u32 stride, android::BufferTransformFlags transform,
                         const Common::Rectangle<int>& crop_rect) {
     const VAddr addr = nvmap_dev->GetObjectAddress(buffer_handle);
     LOG_TRACE(Service,
               "Drawing from address {:X} offset {:08X} Width {} Height {} Stride {} Format {}",
               addr, offset, width, height, stride, format);
 
-    const auto pixel_format = static_cast<Tegra::FramebufferConfig::PixelFormat>(format);
-    const auto transform_flags = static_cast<Tegra::FramebufferConfig::TransformFlags>(transform);
-    const Tegra::FramebufferConfig framebuffer{addr,   offset,       width,           height,
-                                               stride, pixel_format, transform_flags, crop_rect};
+    const Tegra::FramebufferConfig framebuffer{addr,   offset, width,     height,
+                                               stride, format, transform, crop_rect};
 
     system.GetPerfStats().EndSystemFrame();
     system.GPU().SwapBuffers(&framebuffer);
diff --git a/src/core/hle/service/nvdrv/devices/nvdisp_disp0.h b/src/core/hle/service/nvdrv/devices/nvdisp_disp0.h
index de01e1d5f..30b5da429 100644
--- a/src/core/hle/service/nvdrv/devices/nvdisp_disp0.h
+++ b/src/core/hle/service/nvdrv/devices/nvdisp_disp0.h
@@ -9,7 +9,8 @@
 #include "common/common_types.h"
 #include "common/math_util.h"
 #include "core/hle/service/nvdrv/devices/nvdevice.h"
-#include "core/hle/service/nvflinger/buffer_queue.h"
+#include "core/hle/service/nvflinger/buffer_transform_flags.h"
+#include "core/hle/service/nvflinger/pixel_format.h"
 
 namespace Service::Nvidia::Devices {
 
@@ -31,8 +32,8 @@ public:
     void OnClose(DeviceFD fd) override;
 
     /// Performs a screen flip, drawing the buffer pointed to by the handle.
-    void flip(u32 buffer_handle, u32 offset, u32 format, u32 width, u32 height, u32 stride,
-              NVFlinger::BufferQueue::BufferTransformFlags transform,
+    void flip(u32 buffer_handle, u32 offset, android::PixelFormat format, u32 width, u32 height,
+              u32 stride, android::BufferTransformFlags transform,
               const Common::Rectangle<int>& crop_rect);
 
 private:
diff --git a/src/core/hle/service/nvdrv/devices/nvhost_ctrl.cpp b/src/core/hle/service/nvdrv/devices/nvhost_ctrl.cpp
index f9b82b504..44c54c665 100644
--- a/src/core/hle/service/nvdrv/devices/nvhost_ctrl.cpp
+++ b/src/core/hle/service/nvdrv/devices/nvhost_ctrl.cpp
@@ -134,7 +134,7 @@ NvResult nvhost_ctrl::IocCtrlEventWait(const std::vector<u8>& input, std::vector
     }
 
     EventState status = events_interface.status[event_id];
-    const bool bad_parameter = status != EventState::Free && status != EventState::Registered;
+    const bool bad_parameter = status == EventState::Busy;
     if (bad_parameter) {
         std::memcpy(output.data(), &params, sizeof(params));
         return NvResult::BadParameter;
diff --git a/src/core/hle/service/nvdrv/devices/nvhost_ctrl_gpu.h b/src/core/hle/service/nvdrv/devices/nvhost_ctrl_gpu.h
index 898d00a17..f434f6929 100644
--- a/src/core/hle/service/nvdrv/devices/nvhost_ctrl_gpu.h
+++ b/src/core/hle/service/nvdrv/devices/nvhost_ctrl_gpu.h
@@ -5,6 +5,8 @@
 #pragma once
 
 #include <vector>
+
+#include "common/common_funcs.h"
 #include "common/common_types.h"
 #include "common/swap.h"
 #include "core/hle/service/nvdrv/devices/nvdevice.h"
diff --git a/src/core/hle/service/nvdrv/devices/nvhost_gpu.cpp b/src/core/hle/service/nvdrv/devices/nvhost_gpu.cpp
index 0a043e386..dde5b1507 100644
--- a/src/core/hle/service/nvdrv/devices/nvhost_gpu.cpp
+++ b/src/core/hle/service/nvdrv/devices/nvhost_gpu.cpp
@@ -187,7 +187,7 @@ NvResult nvhost_gpu::AllocateObjectContext(const std::vector<u8>& input, std::ve
     return NvResult::Success;
 }
 
-static std::vector<Tegra::CommandHeader> BuildWaitCommandList(Fence fence) {
+static std::vector<Tegra::CommandHeader> BuildWaitCommandList(NvFence fence) {
     return {
         Tegra::BuildCommandHeader(Tegra::BufferMethods::FenceValue, 1,
                                   Tegra::SubmissionMode::Increasing),
@@ -198,7 +198,8 @@ static std::vector<Tegra::CommandHeader> BuildWaitCommandList(Fence fence) {
     };
 }
 
-static std::vector<Tegra::CommandHeader> BuildIncrementCommandList(Fence fence, u32 add_increment) {
+static std::vector<Tegra::CommandHeader> BuildIncrementCommandList(NvFence fence,
+                                                                   u32 add_increment) {
     std::vector<Tegra::CommandHeader> result{
         Tegra::BuildCommandHeader(Tegra::BufferMethods::FenceValue, 1,
                                   Tegra::SubmissionMode::Increasing),
@@ -213,7 +214,7 @@ static std::vector<Tegra::CommandHeader> BuildIncrementCommandList(Fence fence,
     return result;
 }
 
-static std::vector<Tegra::CommandHeader> BuildIncrementWithWfiCommandList(Fence fence,
+static std::vector<Tegra::CommandHeader> BuildIncrementWithWfiCommandList(NvFence fence,
                                                                           u32 add_increment) {
     std::vector<Tegra::CommandHeader> result{
         Tegra::BuildCommandHeader(Tegra::BufferMethods::WaitForInterrupt, 1,
diff --git a/src/core/hle/service/nvdrv/devices/nvhost_gpu.h b/src/core/hle/service/nvdrv/devices/nvhost_gpu.h
index f27a82bff..b2e943e45 100644
--- a/src/core/hle/service/nvdrv/devices/nvhost_gpu.h
+++ b/src/core/hle/service/nvdrv/devices/nvhost_gpu.h
@@ -7,6 +7,7 @@
 #include <memory>
 #include <vector>
 #include "common/bit_field.h"
+#include "common/common_funcs.h"
 #include "common/common_types.h"
 #include "common/swap.h"
 #include "core/hle/service/nvdrv/devices/nvdevice.h"
@@ -108,7 +109,7 @@ private:
     static_assert(sizeof(IoctlGetErrorNotification) == 16,
                   "IoctlGetErrorNotification is incorrect size");
 
-    static_assert(sizeof(Fence) == 8, "Fence is incorrect size");
+    static_assert(sizeof(NvFence) == 8, "Fence is incorrect size");
 
     struct IoctlAllocGpfifoEx {
         u32_le num_entries{};
@@ -126,7 +127,7 @@ private:
         u32_le num_entries{}; // in
         u32_le flags{};       // in
         u32_le unk0{};        // in (1 works)
-        Fence fence_out{};    // out
+        NvFence fence_out{};  // out
         u32_le unk1{};        // in
         u32_le unk2{};        // in
         u32_le unk3{};        // in
@@ -152,13 +153,13 @@ private:
             BitField<4, 1, u32_le> suppress_wfi;  // suppress wait for interrupt
             BitField<8, 1, u32_le> increment;     // increment the returned fence
         } flags;
-        Fence fence_out{}; // returned new fence object for others to wait on
+        NvFence fence_out{}; // returned new fence object for others to wait on
 
         u32 AddIncrementValue() const {
             return flags.add_increment.Value() << 1;
         }
     };
-    static_assert(sizeof(IoctlSubmitGpfifo) == 16 + sizeof(Fence),
+    static_assert(sizeof(IoctlSubmitGpfifo) == 16 + sizeof(NvFence),
                   "IoctlSubmitGpfifo is incorrect size");
 
     struct IoctlGetWaitbase {
@@ -193,7 +194,7 @@ private:
 
     std::shared_ptr<nvmap> nvmap_dev;
     SyncpointManager& syncpoint_manager;
-    Fence channel_fence;
+    NvFence channel_fence;
 };
 
 } // namespace Service::Nvidia::Devices
diff --git a/src/core/hle/service/nvdrv/nvdata.h b/src/core/hle/service/nvdrv/nvdata.h
index 5ab221fc1..3069c3c80 100644
--- a/src/core/hle/service/nvdrv/nvdata.h
+++ b/src/core/hle/service/nvdrv/nvdata.h
@@ -16,17 +16,11 @@ using DeviceFD = s32;
 
 constexpr DeviceFD INVALID_NVDRV_FD = -1;
 
-struct Fence {
+struct NvFence {
     s32 id;
     u32 value;
 };
-
-static_assert(sizeof(Fence) == 8, "Fence has wrong size");
-
-struct MultiFence {
-    u32 num_fences;
-    std::array<Fence, 4> fences;
-};
+static_assert(sizeof(NvFence) == 8, "NvFence has wrong size");
 
 enum class NvResult : u32 {
     Success = 0x0,
diff --git a/src/core/hle/service/nvdrv/nvdrv.h b/src/core/hle/service/nvdrv/nvdrv.h
index a5af5b785..11cf6c0d1 100644
--- a/src/core/hle/service/nvdrv/nvdrv.h
+++ b/src/core/hle/service/nvdrv/nvdrv.h
@@ -12,6 +12,7 @@
 #include "core/hle/service/kernel_helpers.h"
 #include "core/hle/service/nvdrv/nvdata.h"
 #include "core/hle/service/nvdrv/syncpoint_manager.h"
+#include "core/hle/service/nvflinger/ui/fence.h"
 #include "core/hle/service/service.h"
 
 namespace Core {
@@ -37,7 +38,7 @@ class nvdevice;
 /// Represents an Nvidia event
 struct NvEvent {
     Kernel::KEvent* event{};
-    Fence fence{};
+    NvFence fence{};
 };
 
 struct EventInterface {
diff --git a/src/core/hle/service/nvdrv/nvdrv_interface.cpp b/src/core/hle/service/nvdrv/nvdrv_interface.cpp
index c16babe14..8467b50e4 100644
--- a/src/core/hle/service/nvdrv/nvdrv_interface.cpp
+++ b/src/core/hle/service/nvdrv/nvdrv_interface.cpp
@@ -26,7 +26,7 @@ void NVDRV::Open(Kernel::HLERequestContext& ctx) {
         rb.Push<DeviceFD>(0);
         rb.PushEnum(NvResult::NotInitialized);
 
-        LOG_ERROR(Service_NVDRV, "NvServices is not initalized!");
+        LOG_ERROR(Service_NVDRV, "NvServices is not initialized!");
         return;
     }
 
@@ -61,7 +61,7 @@ void NVDRV::Ioctl1(Kernel::HLERequestContext& ctx) {
 
     if (!is_initialized) {
         ServiceError(ctx, NvResult::NotInitialized);
-        LOG_ERROR(Service_NVDRV, "NvServices is not initalized!");
+        LOG_ERROR(Service_NVDRV, "NvServices is not initialized!");
         return;
     }
 
@@ -87,7 +87,7 @@ void NVDRV::Ioctl2(Kernel::HLERequestContext& ctx) {
 
     if (!is_initialized) {
         ServiceError(ctx, NvResult::NotInitialized);
-        LOG_ERROR(Service_NVDRV, "NvServices is not initalized!");
+        LOG_ERROR(Service_NVDRV, "NvServices is not initialized!");
         return;
     }
 
@@ -114,7 +114,7 @@ void NVDRV::Ioctl3(Kernel::HLERequestContext& ctx) {
 
     if (!is_initialized) {
         ServiceError(ctx, NvResult::NotInitialized);
-        LOG_ERROR(Service_NVDRV, "NvServices is not initalized!");
+        LOG_ERROR(Service_NVDRV, "NvServices is not initialized!");
         return;
     }
 
@@ -139,7 +139,7 @@ void NVDRV::Close(Kernel::HLERequestContext& ctx) {
 
     if (!is_initialized) {
         ServiceError(ctx, NvResult::NotInitialized);
-        LOG_ERROR(Service_NVDRV, "NvServices is not initalized!");
+        LOG_ERROR(Service_NVDRV, "NvServices is not initialized!");
         return;
     }
 
@@ -170,7 +170,7 @@ void NVDRV::QueryEvent(Kernel::HLERequestContext& ctx) {
 
     if (!is_initialized) {
         ServiceError(ctx, NvResult::NotInitialized);
-        LOG_ERROR(Service_NVDRV, "NvServices is not initalized!");
+        LOG_ERROR(Service_NVDRV, "NvServices is not initialized!");
         return;
     }
 
@@ -230,7 +230,7 @@ void NVDRV::DumpGraphicsMemoryInfo(Kernel::HLERequestContext& ctx) {
 }
 
 NVDRV::NVDRV(Core::System& system_, std::shared_ptr<Module> nvdrv_, const char* name)
-    : ServiceFramework{system_, name}, nvdrv{std::move(nvdrv_)} {
+    : ServiceFramework{system_, name, ServiceThreadType::CreateNew}, nvdrv{std::move(nvdrv_)} {
     static const FunctionInfo functions[] = {
         {0, &NVDRV::Open, "Open"},
         {1, &NVDRV::Ioctl1, "Ioctl"},
diff --git a/src/core/hle/service/nvflinger/binder.h b/src/core/hle/service/nvflinger/binder.h
new file mode 100644
index 000000000..7d0d4d819
--- /dev/null
+++ b/src/core/hle/service/nvflinger/binder.h
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2014 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/binder/IBinder.h
+
+#pragma once
+
+#include "common/common_types.h"
+
+namespace Kernel {
+class HLERequestContext;
+class KReadableEvent;
+} // namespace Kernel
+
+namespace Service::android {
+
+enum class TransactionId {
+    RequestBuffer = 1,
+    SetBufferCount = 2,
+    DequeueBuffer = 3,
+    DetachBuffer = 4,
+    DetachNextBuffer = 5,
+    AttachBuffer = 6,
+    QueueBuffer = 7,
+    CancelBuffer = 8,
+    Query = 9,
+    Connect = 10,
+    Disconnect = 11,
+    AllocateBuffers = 13,
+    SetPreallocatedBuffer = 14,
+    GetBufferHistory = 17,
+};
+
+class IBinder {
+public:
+    virtual void Transact(Kernel::HLERequestContext& ctx, android::TransactionId code,
+                          u32 flags) = 0;
+    virtual Kernel::KReadableEvent& GetNativeHandle() = 0;
+};
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/buffer_item.h b/src/core/hle/service/nvflinger/buffer_item.h
new file mode 100644
index 000000000..64b82b851
--- /dev/null
+++ b/src/core/hle/service/nvflinger/buffer_item.h
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2014 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/gui/BufferItem.h
+
+#pragma once
+
+#include <memory>
+
+#include "common/common_types.h"
+#include "common/math_util.h"
+#include "core/hle/service/nvflinger/ui/fence.h"
+#include "core/hle/service/nvflinger/window.h"
+
+namespace Service::android {
+
+class GraphicBuffer;
+
+class BufferItem final {
+public:
+    constexpr BufferItem() = default;
+
+    std::shared_ptr<GraphicBuffer> graphic_buffer;
+    Fence fence;
+    Common::Rectangle<s32> crop;
+    NativeWindowTransform transform{};
+    u32 scaling_mode{};
+    s64 timestamp{};
+    bool is_auto_timestamp{};
+    u64 frame_number{};
+
+    // The default value for buf, used to indicate this doesn't correspond to a slot.
+    static constexpr s32 INVALID_BUFFER_SLOT = -1;
+    union {
+        s32 slot{INVALID_BUFFER_SLOT};
+        s32 buf;
+    };
+
+    bool is_droppable{};
+    bool acquire_called{};
+    bool transform_to_display_inverse{};
+    s32 swap_interval{};
+};
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/buffer_item_consumer.cpp b/src/core/hle/service/nvflinger/buffer_item_consumer.cpp
new file mode 100644
index 000000000..d7ee5362b
--- /dev/null
+++ b/src/core/hle/service/nvflinger/buffer_item_consumer.cpp
@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2012 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/libs/gui/BufferItemConsumer.cpp
+
+#include "common/assert.h"
+#include "common/logging/log.h"
+#include "core/hle/service/nvflinger/buffer_item.h"
+#include "core/hle/service/nvflinger/buffer_item_consumer.h"
+#include "core/hle/service/nvflinger/buffer_queue_consumer.h"
+
+namespace Service::android {
+
+BufferItemConsumer::BufferItemConsumer(std::unique_ptr<BufferQueueConsumer> consumer_)
+    : ConsumerBase{std::move(consumer_)} {}
+
+Status BufferItemConsumer::AcquireBuffer(BufferItem* item, std::chrono::nanoseconds present_when,
+                                         bool wait_for_fence) {
+    if (!item) {
+        return Status::BadValue;
+    }
+
+    std::scoped_lock lock{mutex};
+
+    if (const auto status = AcquireBufferLocked(item, present_when); status != Status::NoError) {
+        if (status != Status::NoBufferAvailable) {
+            LOG_ERROR(Service_NVFlinger, "Failed to acquire buffer: {}", status);
+        }
+        return status;
+    }
+
+    if (wait_for_fence) {
+        UNIMPLEMENTED();
+    }
+
+    item->graphic_buffer = slots[item->slot].graphic_buffer;
+
+    return Status::NoError;
+}
+
+Status BufferItemConsumer::ReleaseBuffer(const BufferItem& item, Fence& release_fence) {
+    std::scoped_lock lock{mutex};
+
+    if (const auto status = AddReleaseFenceLocked(item.buf, item.graphic_buffer, release_fence);
+        status != Status::NoError) {
+        LOG_ERROR(Service_NVFlinger, "Failed to add fence: {}", status);
+    }
+
+    if (const auto status = ReleaseBufferLocked(item.buf, item.graphic_buffer);
+        status != Status::NoError) {
+        LOG_WARNING(Service_NVFlinger, "Failed to release buffer: {}", status);
+        return status;
+    }
+
+    return Status::NoError;
+}
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/buffer_item_consumer.h b/src/core/hle/service/nvflinger/buffer_item_consumer.h
new file mode 100644
index 000000000..536db81e2
--- /dev/null
+++ b/src/core/hle/service/nvflinger/buffer_item_consumer.h
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2012 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/gui/BufferItemConsumer.h
+
+#pragma once
+
+#include <chrono>
+#include <memory>
+
+#include "common/common_types.h"
+#include "core/hle/service/nvflinger/consumer_base.h"
+#include "core/hle/service/nvflinger/status.h"
+
+namespace Service::android {
+
+class BufferItem;
+
+class BufferItemConsumer final : public ConsumerBase {
+public:
+    explicit BufferItemConsumer(std::unique_ptr<BufferQueueConsumer> consumer);
+    Status AcquireBuffer(BufferItem* item, std::chrono::nanoseconds present_when,
+                         bool wait_for_fence = true);
+    Status ReleaseBuffer(const BufferItem& item, Fence& release_fence);
+};
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/buffer_queue.cpp b/src/core/hle/service/nvflinger/buffer_queue.cpp
deleted file mode 100644
index 5fead6d1b..000000000
--- a/src/core/hle/service/nvflinger/buffer_queue.cpp
+++ /dev/null
@@ -1,206 +0,0 @@
-// Copyright 2018 yuzu emulator team
-// Licensed under GPLv2 or any later version
-// Refer to the license.txt file included.
-
-#include <algorithm>
-
-#include "common/assert.h"
-#include "common/logging/log.h"
-#include "core/core.h"
-#include "core/hle/kernel/k_writable_event.h"
-#include "core/hle/kernel/kernel.h"
-#include "core/hle/service/kernel_helpers.h"
-#include "core/hle/service/nvflinger/buffer_queue.h"
-
-namespace Service::NVFlinger {
-
-BufferQueue::BufferQueue(Kernel::KernelCore& kernel, u32 id_, u64 layer_id_,
-                         KernelHelpers::ServiceContext& service_context_)
-    : id(id_), layer_id(layer_id_), service_context{service_context_} {
-    buffer_wait_event = service_context.CreateEvent("BufferQueue:WaitEvent");
-}
-
-BufferQueue::~BufferQueue() {
-    service_context.CloseEvent(buffer_wait_event);
-}
-
-void BufferQueue::SetPreallocatedBuffer(u32 slot, const IGBPBuffer& igbp_buffer) {
-    ASSERT(slot < buffer_slots);
-    LOG_WARNING(Service, "Adding graphics buffer {}", slot);
-
-    {
-        std::unique_lock lock{free_buffers_mutex};
-        free_buffers.push_back(slot);
-    }
-    free_buffers_condition.notify_one();
-
-    buffers[slot] = {
-        .slot = slot,
-        .status = Buffer::Status::Free,
-        .igbp_buffer = igbp_buffer,
-        .transform = {},
-        .crop_rect = {},
-        .swap_interval = 0,
-        .multi_fence = {},
-    };
-
-    buffer_wait_event->GetWritableEvent().Signal();
-}
-
-std::optional<std::pair<u32, Service::Nvidia::MultiFence*>> BufferQueue::DequeueBuffer(u32 width,
-                                                                                       u32 height) {
-    // Wait for first request before trying to dequeue
-    {
-        std::unique_lock lock{free_buffers_mutex};
-        free_buffers_condition.wait(lock, [this] { return !free_buffers.empty() || !is_connect; });
-    }
-
-    if (!is_connect) {
-        // Buffer was disconnected while the thread was blocked, this is most likely due to
-        // emulation being stopped
-        return std::nullopt;
-    }
-
-    std::unique_lock lock{free_buffers_mutex};
-
-    auto f_itr = free_buffers.begin();
-    auto slot = buffers.size();
-
-    while (f_itr != free_buffers.end()) {
-        const Buffer& buffer = buffers[*f_itr];
-        if (buffer.status == Buffer::Status::Free && buffer.igbp_buffer.width == width &&
-            buffer.igbp_buffer.height == height) {
-            slot = *f_itr;
-            free_buffers.erase(f_itr);
-            break;
-        }
-        ++f_itr;
-    }
-    if (slot == buffers.size()) {
-        return std::nullopt;
-    }
-    buffers[slot].status = Buffer::Status::Dequeued;
-    return {{buffers[slot].slot, &buffers[slot].multi_fence}};
-}
-
-const IGBPBuffer& BufferQueue::RequestBuffer(u32 slot) const {
-    ASSERT(slot < buffers.size());
-    ASSERT(buffers[slot].status == Buffer::Status::Dequeued);
-    ASSERT(buffers[slot].slot == slot);
-
-    return buffers[slot].igbp_buffer;
-}
-
-void BufferQueue::QueueBuffer(u32 slot, BufferTransformFlags transform,
-                              const Common::Rectangle<int>& crop_rect, u32 swap_interval,
-                              Service::Nvidia::MultiFence& multi_fence) {
-    ASSERT(slot < buffers.size());
-    ASSERT(buffers[slot].status == Buffer::Status::Dequeued);
-    ASSERT(buffers[slot].slot == slot);
-
-    buffers[slot].status = Buffer::Status::Queued;
-    buffers[slot].transform = transform;
-    buffers[slot].crop_rect = crop_rect;
-    buffers[slot].swap_interval = swap_interval;
-    buffers[slot].multi_fence = multi_fence;
-    std::unique_lock lock{queue_sequence_mutex};
-    queue_sequence.push_back(slot);
-}
-
-void BufferQueue::CancelBuffer(u32 slot, const Service::Nvidia::MultiFence& multi_fence) {
-    ASSERT(slot < buffers.size());
-    ASSERT(buffers[slot].status != Buffer::Status::Free);
-    ASSERT(buffers[slot].slot == slot);
-
-    buffers[slot].status = Buffer::Status::Free;
-    buffers[slot].multi_fence = multi_fence;
-    buffers[slot].swap_interval = 0;
-
-    {
-        std::unique_lock lock{free_buffers_mutex};
-        free_buffers.push_back(slot);
-    }
-    free_buffers_condition.notify_one();
-
-    buffer_wait_event->GetWritableEvent().Signal();
-}
-
-std::optional<std::reference_wrapper<const BufferQueue::Buffer>> BufferQueue::AcquireBuffer() {
-    std::unique_lock lock{queue_sequence_mutex};
-    std::size_t buffer_slot = buffers.size();
-    // Iterate to find a queued buffer matching the requested slot.
-    while (buffer_slot == buffers.size() && !queue_sequence.empty()) {
-        const auto slot = static_cast<std::size_t>(queue_sequence.front());
-        ASSERT(slot < buffers.size());
-        if (buffers[slot].status == Buffer::Status::Queued) {
-            ASSERT(buffers[slot].slot == slot);
-            buffer_slot = slot;
-        }
-        queue_sequence.pop_front();
-    }
-    if (buffer_slot == buffers.size()) {
-        return std::nullopt;
-    }
-    buffers[buffer_slot].status = Buffer::Status::Acquired;
-    return {{buffers[buffer_slot]}};
-}
-
-void BufferQueue::ReleaseBuffer(u32 slot) {
-    ASSERT(slot < buffers.size());
-    ASSERT(buffers[slot].status == Buffer::Status::Acquired);
-    ASSERT(buffers[slot].slot == slot);
-
-    buffers[slot].status = Buffer::Status::Free;
-    {
-        std::unique_lock lock{free_buffers_mutex};
-        free_buffers.push_back(slot);
-    }
-    free_buffers_condition.notify_one();
-
-    buffer_wait_event->GetWritableEvent().Signal();
-}
-
-void BufferQueue::Connect() {
-    std::unique_lock lock{queue_sequence_mutex};
-    queue_sequence.clear();
-    is_connect = true;
-}
-
-void BufferQueue::Disconnect() {
-    buffers.fill({});
-    {
-        std::unique_lock lock{queue_sequence_mutex};
-        queue_sequence.clear();
-    }
-    buffer_wait_event->GetWritableEvent().Signal();
-    is_connect = false;
-    free_buffers_condition.notify_one();
-}
-
-u32 BufferQueue::Query(QueryType type) {
-    LOG_WARNING(Service, "(STUBBED) called type={}", type);
-
-    switch (type) {
-    case QueryType::NativeWindowFormat:
-        return static_cast<u32>(PixelFormat::RGBA8888);
-    case QueryType::NativeWindowWidth:
-    case QueryType::NativeWindowHeight:
-        break;
-    case QueryType::NativeWindowMinUndequeuedBuffers:
-        return 0;
-    case QueryType::NativeWindowConsumerUsageBits:
-        return 0;
-    }
-    UNIMPLEMENTED_MSG("Unimplemented query type={}", type);
-    return 0;
-}
-
-Kernel::KWritableEvent& BufferQueue::GetWritableBufferWaitEvent() {
-    return buffer_wait_event->GetWritableEvent();
-}
-
-Kernel::KReadableEvent& BufferQueue::GetBufferWaitEvent() {
-    return buffer_wait_event->GetReadableEvent();
-}
-
-} // namespace Service::NVFlinger
diff --git a/src/core/hle/service/nvflinger/buffer_queue.h b/src/core/hle/service/nvflinger/buffer_queue.h
deleted file mode 100644
index f2a579133..000000000
--- a/src/core/hle/service/nvflinger/buffer_queue.h
+++ /dev/null
@@ -1,154 +0,0 @@
-// Copyright 2018 yuzu emulator team
-// Licensed under GPLv2 or any later version
-// Refer to the license.txt file included.
-
-#pragma once
-
-#include <condition_variable>
-#include <list>
-#include <mutex>
-#include <optional>
-
-#include "common/common_funcs.h"
-#include "common/math_util.h"
-#include "common/swap.h"
-#include "core/hle/kernel/k_event.h"
-#include "core/hle/kernel/k_readable_event.h"
-#include "core/hle/service/nvdrv/nvdata.h"
-
-namespace Kernel {
-class KernelCore;
-class KEvent;
-class KReadableEvent;
-class KWritableEvent;
-} // namespace Kernel
-
-namespace Service::KernelHelpers {
-class ServiceContext;
-} // namespace Service::KernelHelpers
-
-namespace Service::NVFlinger {
-
-constexpr u32 buffer_slots = 0x40;
-struct IGBPBuffer {
-    u32_le magic;
-    u32_le width;
-    u32_le height;
-    u32_le stride;
-    u32_le format;
-    u32_le usage;
-    INSERT_PADDING_WORDS(1);
-    u32_le index;
-    INSERT_PADDING_WORDS(3);
-    u32_le gpu_buffer_id;
-    INSERT_PADDING_WORDS(6);
-    u32_le external_format;
-    INSERT_PADDING_WORDS(10);
-    u32_le nvmap_handle;
-    u32_le offset;
-    INSERT_PADDING_WORDS(60);
-};
-
-static_assert(sizeof(IGBPBuffer) == 0x16C, "IGBPBuffer has wrong size");
-
-class BufferQueue final {
-public:
-    enum class QueryType {
-        NativeWindowWidth = 0,
-        NativeWindowHeight = 1,
-        NativeWindowFormat = 2,
-        /// The minimum number of buffers that must remain un-dequeued after a buffer has been
-        /// queued
-        NativeWindowMinUndequeuedBuffers = 3,
-        /// The consumer gralloc usage bits currently set by the consumer
-        NativeWindowConsumerUsageBits = 10,
-    };
-
-    explicit BufferQueue(Kernel::KernelCore& kernel, u32 id_, u64 layer_id_,
-                         KernelHelpers::ServiceContext& service_context_);
-    ~BufferQueue();
-
-    enum class BufferTransformFlags : u32 {
-        /// No transform flags are set
-        Unset = 0x00,
-        /// Flip source image horizontally (around the vertical axis)
-        FlipH = 0x01,
-        /// Flip source image vertically (around the horizontal axis)
-        FlipV = 0x02,
-        /// Rotate source image 90 degrees clockwise
-        Rotate90 = 0x04,
-        /// Rotate source image 180 degrees
-        Rotate180 = 0x03,
-        /// Rotate source image 270 degrees clockwise
-        Rotate270 = 0x07,
-    };
-
-    enum class PixelFormat : u32 {
-        RGBA8888 = 1,
-        RGBX8888 = 2,
-        RGB888 = 3,
-        RGB565 = 4,
-        BGRA8888 = 5,
-        RGBA5551 = 6,
-        RRGBA4444 = 7,
-    };
-
-    struct Buffer {
-        enum class Status { Free = 0, Queued = 1, Dequeued = 2, Acquired = 3 };
-
-        u32 slot;
-        Status status = Status::Free;
-        IGBPBuffer igbp_buffer;
-        BufferTransformFlags transform;
-        Common::Rectangle<int> crop_rect;
-        u32 swap_interval;
-        Service::Nvidia::MultiFence multi_fence;
-    };
-
-    void SetPreallocatedBuffer(u32 slot, const IGBPBuffer& igbp_buffer);
-    std::optional<std::pair<u32, Service::Nvidia::MultiFence*>> DequeueBuffer(u32 width,
-                                                                              u32 height);
-    const IGBPBuffer& RequestBuffer(u32 slot) const;
-    void QueueBuffer(u32 slot, BufferTransformFlags transform,
-                     const Common::Rectangle<int>& crop_rect, u32 swap_interval,
-                     Service::Nvidia::MultiFence& multi_fence);
-    void CancelBuffer(u32 slot, const Service::Nvidia::MultiFence& multi_fence);
-    std::optional<std::reference_wrapper<const Buffer>> AcquireBuffer();
-    void ReleaseBuffer(u32 slot);
-    void Connect();
-    void Disconnect();
-    u32 Query(QueryType type);
-
-    u32 GetId() const {
-        return id;
-    }
-
-    bool IsConnected() const {
-        return is_connect;
-    }
-
-    Kernel::KWritableEvent& GetWritableBufferWaitEvent();
-
-    Kernel::KReadableEvent& GetBufferWaitEvent();
-
-private:
-    BufferQueue(const BufferQueue&) = delete;
-
-    u32 id{};
-    u64 layer_id{};
-    std::atomic_bool is_connect{};
-
-    std::list<u32> free_buffers;
-    std::array<Buffer, buffer_slots> buffers;
-    std::list<u32> queue_sequence;
-    Kernel::KEvent* buffer_wait_event{};
-
-    std::mutex free_buffers_mutex;
-    std::condition_variable free_buffers_condition;
-
-    std::mutex queue_sequence_mutex;
-
-    KernelHelpers::ServiceContext& service_context;
-};
-
-} // namespace Service::NVFlinger
diff --git a/src/core/hle/service/nvflinger/buffer_queue_consumer.cpp b/src/core/hle/service/nvflinger/buffer_queue_consumer.cpp
new file mode 100644
index 000000000..3ab9a8c05
--- /dev/null
+++ b/src/core/hle/service/nvflinger/buffer_queue_consumer.cpp
@@ -0,0 +1,231 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2014 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/libs/gui/BufferQueueConsumer.cpp
+
+#include "common/logging/log.h"
+#include "core/hle/service/nvflinger/buffer_item.h"
+#include "core/hle/service/nvflinger/buffer_queue_consumer.h"
+#include "core/hle/service/nvflinger/buffer_queue_core.h"
+#include "core/hle/service/nvflinger/producer_listener.h"
+
+namespace Service::android {
+
+BufferQueueConsumer::BufferQueueConsumer(std::shared_ptr<BufferQueueCore> core_)
+    : core{std::move(core_)}, slots{core->slots} {}
+
+BufferQueueConsumer::~BufferQueueConsumer() = default;
+
+Status BufferQueueConsumer::AcquireBuffer(BufferItem* out_buffer,
+                                          std::chrono::nanoseconds expected_present) {
+    std::scoped_lock lock{core->mutex};
+
+    // Check that the consumer doesn't currently have the maximum number of buffers acquired.
+    const s32 num_acquired_buffers{
+        static_cast<s32>(std::count_if(slots.begin(), slots.end(), [](const auto& slot) {
+            return slot.buffer_state == BufferState::Acquired;
+        }))};
+
+    if (num_acquired_buffers >= core->max_acquired_buffer_count + 1) {
+        LOG_ERROR(Service_NVFlinger, "max acquired buffer count reached: {} (max {})",
+                  num_acquired_buffers, core->max_acquired_buffer_count);
+        return Status::InvalidOperation;
+    }
+
+    // Check if the queue is empty.
+    if (core->queue.empty()) {
+        return Status::NoBufferAvailable;
+    }
+
+    auto front(core->queue.begin());
+
+    // If expected_present is specified, we may not want to return a buffer yet.
+    if (expected_present.count() != 0) {
+        constexpr auto MAX_REASONABLE_NSEC = 1000000000LL; // 1 second
+
+        // The expected_present argument indicates when the buffer is expected to be presented
+        // on-screen.
+        while (core->queue.size() > 1 && !core->queue[0].is_auto_timestamp) {
+            const auto& buffer_item{core->queue[1]};
+
+            // If entry[1] is timely, drop entry[0] (and repeat).
+            const auto desired_present = buffer_item.timestamp;
+            if (desired_present < expected_present.count() - MAX_REASONABLE_NSEC ||
+                desired_present > expected_present.count()) {
+                // This buffer is set to display in the near future, or desired_present is garbage.
+                LOG_DEBUG(Service_NVFlinger, "nodrop desire={} expect={}", desired_present,
+                          expected_present.count());
+                break;
+            }
+
+            LOG_DEBUG(Service_NVFlinger, "drop desire={} expect={} size={}", desired_present,
+                      expected_present.count(), core->queue.size());
+
+            if (core->StillTracking(*front)) {
+                // Front buffer is still in mSlots, so mark the slot as free
+                slots[front->slot].buffer_state = BufferState::Free;
+            }
+
+            core->queue.erase(front);
+            front = core->queue.begin();
+        }
+
+        // See if the front buffer is ready to be acquired.
+        const auto desired_present = front->timestamp;
+        if (desired_present > expected_present.count() &&
+            desired_present < expected_present.count() + MAX_REASONABLE_NSEC) {
+            LOG_DEBUG(Service_NVFlinger, "defer desire={} expect={}", desired_present,
+                      expected_present.count());
+            return Status::PresentLater;
+        }
+
+        LOG_DEBUG(Service_NVFlinger, "accept desire={} expect={}", desired_present,
+                  expected_present.count());
+    }
+
+    const auto slot = front->slot;
+    *out_buffer = *front;
+
+    LOG_DEBUG(Service_NVFlinger, "acquiring slot={}", slot);
+
+    // If the front buffer is still being tracked, update its slot state
+    if (core->StillTracking(*front)) {
+        slots[slot].acquire_called = true;
+        slots[slot].needs_cleanup_on_release = false;
+        slots[slot].buffer_state = BufferState::Acquired;
+        slots[slot].fence = Fence::NoFence();
+    }
+
+    // If the buffer has previously been acquired by the consumer, set graphic_buffer to nullptr to
+    // avoid unnecessarily remapping this buffer on the consumer side.
+    if (out_buffer->acquire_called) {
+        out_buffer->graphic_buffer = nullptr;
+    }
+
+    core->queue.erase(front);
+
+    // We might have freed a slot while dropping old buffers, or the producer  may be blocked
+    // waiting for the number of buffers in the queue to decrease.
+    core->SignalDequeueCondition();
+
+    return Status::NoError;
+}
+
+Status BufferQueueConsumer::ReleaseBuffer(s32 slot, u64 frame_number, const Fence& release_fence) {
+    if (slot < 0 || slot >= BufferQueueDefs::NUM_BUFFER_SLOTS) {
+        LOG_ERROR(Service_NVFlinger, "slot {} out of range", slot);
+        return Status::BadValue;
+    }
+
+    std::shared_ptr<IProducerListener> listener;
+    {
+        std::scoped_lock lock{core->mutex};
+
+        // If the frame number has changed because the buffer has been reallocated, we can ignore
+        // this ReleaseBuffer for the old buffer.
+        if (frame_number != slots[slot].frame_number) {
+            return Status::StaleBufferSlot;
+        }
+
+        // Make sure this buffer hasn't been queued while acquired by the consumer.
+        auto current(core->queue.begin());
+        while (current != core->queue.end()) {
+            if (current->slot == slot) {
+                LOG_ERROR(Service_NVFlinger, "buffer slot {} pending release is currently queued",
+                          slot);
+                return Status::BadValue;
+            }
+            ++current;
+        }
+
+        if (slots[slot].buffer_state == BufferState::Acquired) {
+            slots[slot].fence = release_fence;
+            slots[slot].buffer_state = BufferState::Free;
+
+            listener = core->connected_producer_listener;
+
+            LOG_DEBUG(Service_NVFlinger, "releasing slot {}", slot);
+        } else if (slots[slot].needs_cleanup_on_release) {
+            LOG_DEBUG(Service_NVFlinger, "releasing a stale buffer slot {} (state = {})", slot,
+                      slots[slot].buffer_state);
+
+            slots[slot].needs_cleanup_on_release = false;
+
+            return Status::StaleBufferSlot;
+        } else {
+            LOG_ERROR(Service_NVFlinger, "attempted to release buffer slot {} but its state was {}",
+                      slot, slots[slot].buffer_state);
+
+            return Status::BadValue;
+        }
+
+        core->SignalDequeueCondition();
+    }
+
+    // Call back without lock held
+    if (listener != nullptr) {
+        listener->OnBufferReleased();
+    }
+
+    return Status::NoError;
+}
+
+Status BufferQueueConsumer::Connect(std::shared_ptr<IConsumerListener> consumer_listener,
+                                    bool controlled_by_app) {
+    if (consumer_listener == nullptr) {
+        LOG_ERROR(Service_NVFlinger, "consumer_listener may not be nullptr");
+        return Status::BadValue;
+    }
+
+    LOG_DEBUG(Service_NVFlinger, "controlled_by_app={}", controlled_by_app);
+
+    std::scoped_lock lock{core->mutex};
+
+    if (core->is_abandoned) {
+        LOG_ERROR(Service_NVFlinger, "BufferQueue has been abandoned");
+        return Status::NoInit;
+    }
+
+    core->consumer_listener = consumer_listener;
+    core->consumer_controlled_by_app = controlled_by_app;
+
+    return Status::NoError;
+}
+
+Status BufferQueueConsumer::GetReleasedBuffers(u64* out_slot_mask) {
+    if (out_slot_mask == nullptr) {
+        LOG_ERROR(Service_NVFlinger, "out_slot_mask may not be nullptr");
+        return Status::BadValue;
+    }
+
+    std::scoped_lock lock{core->mutex};
+
+    if (core->is_abandoned) {
+        LOG_ERROR(Service_NVFlinger, "BufferQueue has been abandoned");
+        return Status::NoInit;
+    }
+
+    u64 mask = 0;
+    for (int s = 0; s < BufferQueueDefs::NUM_BUFFER_SLOTS; ++s) {
+        if (!slots[s].acquire_called) {
+            mask |= (1ULL << s);
+        }
+    }
+
+    // Remove from the mask queued buffers for which acquire has been called, since the consumer
+    // will not receive their buffer addresses and so must retain their cached information
+    auto current(core->queue.begin());
+    while (current != core->queue.end()) {
+        if (current->acquire_called) {
+            mask &= ~(1ULL << current->slot);
+        }
+        ++current;
+    }
+
+    LOG_DEBUG(Service_NVFlinger, "returning mask {}", mask);
+    *out_slot_mask = mask;
+    return Status::NoError;
+}
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/buffer_queue_consumer.h b/src/core/hle/service/nvflinger/buffer_queue_consumer.h
new file mode 100644
index 000000000..8a047fe06
--- /dev/null
+++ b/src/core/hle/service/nvflinger/buffer_queue_consumer.h
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2014 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/gui/BufferQueueConsumer.h
+
+#pragma once
+
+#include <chrono>
+#include <memory>
+
+#include "common/common_types.h"
+#include "core/hle/service/nvflinger/buffer_queue_defs.h"
+#include "core/hle/service/nvflinger/status.h"
+
+namespace Service::android {
+
+class BufferItem;
+class BufferQueueCore;
+class IConsumerListener;
+
+class BufferQueueConsumer final {
+public:
+    explicit BufferQueueConsumer(std::shared_ptr<BufferQueueCore> core_);
+    ~BufferQueueConsumer();
+
+    Status AcquireBuffer(BufferItem* out_buffer, std::chrono::nanoseconds expected_present);
+    Status ReleaseBuffer(s32 slot, u64 frame_number, const Fence& release_fence);
+    Status Connect(std::shared_ptr<IConsumerListener> consumer_listener, bool controlled_by_app);
+    Status GetReleasedBuffers(u64* out_slot_mask);
+
+private:
+    std::shared_ptr<BufferQueueCore> core;
+    BufferQueueDefs::SlotsType& slots;
+};
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/buffer_queue_core.cpp b/src/core/hle/service/nvflinger/buffer_queue_core.cpp
new file mode 100644
index 000000000..ec5aabaeb
--- /dev/null
+++ b/src/core/hle/service/nvflinger/buffer_queue_core.cpp
@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2014 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/libs/gui/BufferQueueCore.cpp
+
+#include "common/assert.h"
+
+#include "core/hle/service/nvflinger/buffer_queue_core.h"
+
+namespace Service::android {
+
+BufferQueueCore::BufferQueueCore() = default;
+
+BufferQueueCore::~BufferQueueCore() = default;
+
+void BufferQueueCore::NotifyShutdown() {
+    std::scoped_lock lock{mutex};
+
+    is_shutting_down = true;
+
+    SignalDequeueCondition();
+}
+
+void BufferQueueCore::SignalDequeueCondition() {
+    dequeue_condition.notify_all();
+}
+
+bool BufferQueueCore::WaitForDequeueCondition() {
+    if (is_shutting_down) {
+        return false;
+    }
+
+    dequeue_condition.wait(mutex);
+
+    return true;
+}
+
+s32 BufferQueueCore::GetMinUndequeuedBufferCountLocked(bool async) const {
+    // If DequeueBuffer is allowed to error out, we don't have to add an extra buffer.
+    if (!use_async_buffer) {
+        return max_acquired_buffer_count;
+    }
+
+    if (dequeue_buffer_cannot_block || async) {
+        return max_acquired_buffer_count + 1;
+    }
+
+    return max_acquired_buffer_count;
+}
+
+s32 BufferQueueCore::GetMinMaxBufferCountLocked(bool async) const {
+    return GetMinUndequeuedBufferCountLocked(async) + 1;
+}
+
+s32 BufferQueueCore::GetMaxBufferCountLocked(bool async) const {
+    const auto min_buffer_count = GetMinMaxBufferCountLocked(async);
+    auto max_buffer_count = std::max(default_max_buffer_count, min_buffer_count);
+
+    if (override_max_buffer_count != 0) {
+        ASSERT(override_max_buffer_count >= min_buffer_count);
+        max_buffer_count = override_max_buffer_count;
+    }
+
+    // Any buffers that are dequeued by the producer or sitting in the queue waiting to be consumed
+    // need to have their slots preserved.
+    for (s32 slot = max_buffer_count; slot < BufferQueueDefs::NUM_BUFFER_SLOTS; ++slot) {
+        const auto state = slots[slot].buffer_state;
+        if (state == BufferState::Queued || state == BufferState::Dequeued) {
+            max_buffer_count = slot + 1;
+        }
+    }
+
+    return max_buffer_count;
+}
+
+s32 BufferQueueCore::GetPreallocatedBufferCountLocked() const {
+    return static_cast<s32>(std::count_if(slots.begin(), slots.end(),
+                                          [](const auto& slot) { return slot.is_preallocated; }));
+}
+
+void BufferQueueCore::FreeBufferLocked(s32 slot) {
+    LOG_DEBUG(Service_NVFlinger, "slot {}", slot);
+
+    slots[slot].graphic_buffer.reset();
+
+    if (slots[slot].buffer_state == BufferState::Acquired) {
+        slots[slot].needs_cleanup_on_release = true;
+    }
+
+    slots[slot].buffer_state = BufferState::Free;
+    slots[slot].frame_number = UINT32_MAX;
+    slots[slot].acquire_called = false;
+    slots[slot].fence = Fence::NoFence();
+}
+
+void BufferQueueCore::FreeAllBuffersLocked() {
+    buffer_has_been_queued = false;
+
+    for (s32 slot = 0; slot < BufferQueueDefs::NUM_BUFFER_SLOTS; ++slot) {
+        FreeBufferLocked(slot);
+    }
+}
+
+bool BufferQueueCore::StillTracking(const BufferItem& item) const {
+    const BufferSlot& slot = slots[item.slot];
+
+    return (slot.graphic_buffer != nullptr) && (item.graphic_buffer == slot.graphic_buffer);
+}
+
+void BufferQueueCore::WaitWhileAllocatingLocked() const {
+    while (is_allocating) {
+        is_allocating_condition.wait(mutex);
+    }
+}
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/buffer_queue_core.h b/src/core/hle/service/nvflinger/buffer_queue_core.h
new file mode 100644
index 000000000..e4e0937cb
--- /dev/null
+++ b/src/core/hle/service/nvflinger/buffer_queue_core.h
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2014 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/gui/BufferQueueCore.h
+
+#pragma once
+
+#include <condition_variable>
+#include <list>
+#include <memory>
+#include <mutex>
+#include <set>
+#include <vector>
+
+#include "core/hle/service/nvflinger/buffer_item.h"
+#include "core/hle/service/nvflinger/buffer_queue_defs.h"
+#include "core/hle/service/nvflinger/pixel_format.h"
+#include "core/hle/service/nvflinger/status.h"
+#include "core/hle/service/nvflinger/window.h"
+
+namespace Service::android {
+
+class IConsumerListener;
+class IProducerListener;
+
+class BufferQueueCore final {
+    friend class BufferQueueProducer;
+    friend class BufferQueueConsumer;
+
+public:
+    static constexpr s32 INVALID_BUFFER_SLOT = BufferItem::INVALID_BUFFER_SLOT;
+
+    BufferQueueCore();
+    ~BufferQueueCore();
+
+    void NotifyShutdown();
+
+private:
+    void SignalDequeueCondition();
+    bool WaitForDequeueCondition();
+
+    s32 GetMinUndequeuedBufferCountLocked(bool async) const;
+    s32 GetMinMaxBufferCountLocked(bool async) const;
+    s32 GetMaxBufferCountLocked(bool async) const;
+    s32 GetPreallocatedBufferCountLocked() const;
+    void FreeBufferLocked(s32 slot);
+    void FreeAllBuffersLocked();
+    bool StillTracking(const BufferItem& item) const;
+    void WaitWhileAllocatingLocked() const;
+
+private:
+    mutable std::mutex mutex;
+    bool is_abandoned{};
+    bool consumer_controlled_by_app{};
+    std::shared_ptr<IConsumerListener> consumer_listener;
+    u32 consumer_usage_bit{};
+    NativeWindowApi connected_api{NativeWindowApi::NoConnectedApi};
+    std::shared_ptr<IProducerListener> connected_producer_listener;
+    BufferQueueDefs::SlotsType slots{};
+    std::vector<BufferItem> queue;
+    s32 override_max_buffer_count{};
+    mutable std::condition_variable_any dequeue_condition;
+    const bool use_async_buffer{}; // This is always disabled on HOS
+    bool dequeue_buffer_cannot_block{};
+    PixelFormat default_buffer_format{PixelFormat::Rgba8888};
+    u32 default_width{1};
+    u32 default_height{1};
+    s32 default_max_buffer_count{2};
+    const s32 max_acquired_buffer_count{}; // This is always zero on HOS
+    bool buffer_has_been_queued{};
+    u64 frame_counter{};
+    u32 transform_hint{};
+    bool is_allocating{};
+    mutable std::condition_variable_any is_allocating_condition;
+    bool is_shutting_down{};
+};
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/buffer_queue_defs.h b/src/core/hle/service/nvflinger/buffer_queue_defs.h
new file mode 100644
index 000000000..387d3d36a
--- /dev/null
+++ b/src/core/hle/service/nvflinger/buffer_queue_defs.h
@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2014 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/gui/BufferQueueDefs.h
+
+#pragma once
+
+#include <array>
+
+#include "common/common_types.h"
+#include "core/hle/service/nvflinger/buffer_slot.h"
+
+namespace Service::android::BufferQueueDefs {
+
+// BufferQueue will keep track of at most this value of buffers.
+constexpr s32 NUM_BUFFER_SLOTS = 64;
+
+using SlotsType = std::array<BufferSlot, NUM_BUFFER_SLOTS>;
+
+} // namespace Service::android::BufferQueueDefs
diff --git a/src/core/hle/service/nvflinger/buffer_queue_producer.cpp b/src/core/hle/service/nvflinger/buffer_queue_producer.cpp
new file mode 100644
index 000000000..6f604a88e
--- /dev/null
+++ b/src/core/hle/service/nvflinger/buffer_queue_producer.cpp
@@ -0,0 +1,923 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2014 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/libs/gui/BufferQueueProducer.cpp
+
+#include "common/assert.h"
+#include "common/logging/log.h"
+#include "common/settings.h"
+#include "core/core.h"
+#include "core/hle/kernel/hle_ipc.h"
+#include "core/hle/kernel/k_event.h"
+#include "core/hle/kernel/k_readable_event.h"
+#include "core/hle/kernel/k_writable_event.h"
+#include "core/hle/kernel/kernel.h"
+#include "core/hle/service/kernel_helpers.h"
+#include "core/hle/service/nvdrv/nvdrv.h"
+#include "core/hle/service/nvflinger/buffer_queue_core.h"
+#include "core/hle/service/nvflinger/buffer_queue_producer.h"
+#include "core/hle/service/nvflinger/consumer_listener.h"
+#include "core/hle/service/nvflinger/parcel.h"
+#include "core/hle/service/nvflinger/ui/graphic_buffer.h"
+#include "core/hle/service/nvflinger/window.h"
+#include "core/hle/service/vi/vi.h"
+
+namespace Service::android {
+
+BufferQueueProducer::BufferQueueProducer(Service::KernelHelpers::ServiceContext& service_context_,
+                                         std::shared_ptr<BufferQueueCore> buffer_queue_core_)
+    : service_context{service_context_}, core{std::move(buffer_queue_core_)}, slots(core->slots) {
+    buffer_wait_event = service_context.CreateEvent("BufferQueue:WaitEvent");
+}
+
+BufferQueueProducer::~BufferQueueProducer() {
+    service_context.CloseEvent(buffer_wait_event);
+}
+
+Status BufferQueueProducer::RequestBuffer(s32 slot, std::shared_ptr<GraphicBuffer>* buf) {
+    LOG_DEBUG(Service_NVFlinger, "slot {}", slot);
+
+    std::scoped_lock lock{core->mutex};
+
+    if (core->is_abandoned) {
+        LOG_ERROR(Service_NVFlinger, "BufferQueue has been abandoned");
+        return Status::NoInit;
+    }
+    if (slot < 0 || slot >= BufferQueueDefs::NUM_BUFFER_SLOTS) {
+        LOG_ERROR(Service_NVFlinger, "slot index {} out of range [0, {})", slot,
+                  BufferQueueDefs::NUM_BUFFER_SLOTS);
+        return Status::BadValue;
+    } else if (slots[slot].buffer_state != BufferState::Dequeued) {
+        LOG_ERROR(Service_NVFlinger, "slot {} is not owned by the producer (state = {})", slot,
+                  slots[slot].buffer_state);
+        return Status::BadValue;
+    }
+
+    slots[slot].request_buffer_called = true;
+    *buf = slots[slot].graphic_buffer;
+
+    return Status::NoError;
+}
+
+Status BufferQueueProducer::SetBufferCount(s32 buffer_count) {
+    LOG_DEBUG(Service_NVFlinger, "count = {}", buffer_count);
+
+    std::shared_ptr<IConsumerListener> listener;
+    {
+        std::scoped_lock lock{core->mutex};
+        core->WaitWhileAllocatingLocked();
+
+        if (core->is_abandoned) {
+            LOG_ERROR(Service_NVFlinger, "BufferQueue has been abandoned");
+            return Status::NoInit;
+        }
+
+        if (buffer_count > BufferQueueDefs::NUM_BUFFER_SLOTS) {
+            LOG_ERROR(Service_NVFlinger, "buffer_count {} too large (max {})", buffer_count,
+                      BufferQueueDefs::NUM_BUFFER_SLOTS);
+            return Status::BadValue;
+        }
+
+        // There must be no dequeued buffers when changing the buffer count.
+        for (s32 s{}; s < BufferQueueDefs::NUM_BUFFER_SLOTS; ++s) {
+            if (slots[s].buffer_state == BufferState::Dequeued) {
+                LOG_ERROR(Service_NVFlinger, "buffer owned by producer");
+                return Status::BadValue;
+            }
+        }
+
+        if (buffer_count == 0) {
+            core->override_max_buffer_count = 0;
+            core->SignalDequeueCondition();
+            return Status::NoError;
+        }
+
+        const s32 min_buffer_slots = core->GetMinMaxBufferCountLocked(false);
+        if (buffer_count < min_buffer_slots) {
+            LOG_ERROR(Service_NVFlinger, "requested buffer count {} is less than minimum {}",
+                      buffer_count, min_buffer_slots);
+            return Status::BadValue;
+        }
+
+        // Here we are guaranteed that the producer doesn't have any dequeued buffers and will
+        // release all of its buffer references.
+        if (core->GetPreallocatedBufferCountLocked() <= 0) {
+            core->FreeAllBuffersLocked();
+        }
+
+        core->override_max_buffer_count = buffer_count;
+        core->SignalDequeueCondition();
+        buffer_wait_event->GetWritableEvent().Signal();
+        listener = core->consumer_listener;
+    }
+
+    // Call back without lock held
+    if (listener != nullptr) {
+        listener->OnBuffersReleased();
+    }
+
+    return Status::NoError;
+}
+
+Status BufferQueueProducer::WaitForFreeSlotThenRelock(bool async, s32* found,
+                                                      Status* return_flags) const {
+    bool try_again = true;
+
+    while (try_again) {
+        if (core->is_abandoned) {
+            LOG_ERROR(Service_NVFlinger, "BufferQueue has been abandoned");
+            return Status::NoInit;
+        }
+
+        const s32 max_buffer_count = core->GetMaxBufferCountLocked(async);
+        if (async && core->override_max_buffer_count) {
+            if (core->override_max_buffer_count < max_buffer_count) {
+                LOG_ERROR(Service_NVFlinger, "async mode is invalid with buffer count override");
+                return Status::BadValue;
+            }
+        }
+
+        // Free up any buffers that are in slots beyond the max buffer count
+        for (s32 s = max_buffer_count; s < BufferQueueDefs::NUM_BUFFER_SLOTS; ++s) {
+            ASSERT(slots[s].buffer_state == BufferState::Free);
+            if (slots[s].graphic_buffer != nullptr) {
+                core->FreeBufferLocked(s);
+                *return_flags |= Status::ReleaseAllBuffers;
+            }
+        }
+
+        // Look for a free buffer to give to the client
+        *found = BufferQueueCore::INVALID_BUFFER_SLOT;
+        s32 dequeued_count{};
+        s32 acquired_count{};
+        for (s32 s{}; s < max_buffer_count; ++s) {
+            switch (slots[s].buffer_state) {
+            case BufferState::Dequeued:
+                ++dequeued_count;
+                break;
+            case BufferState::Acquired:
+                ++acquired_count;
+                break;
+            case BufferState::Free:
+                // We return the oldest of the free buffers to avoid stalling the producer if
+                // possible, since the consumer may still have pending reads of in-flight buffers
+                if (*found == BufferQueueCore::INVALID_BUFFER_SLOT ||
+                    slots[s].frame_number < slots[*found].frame_number) {
+                    *found = s;
+                }
+                break;
+            default:
+                break;
+            }
+        }
+
+        // Producers are not allowed to dequeue more than one buffer if they did not set a buffer
+        // count
+        if (!core->override_max_buffer_count && dequeued_count) {
+            LOG_ERROR(Service_NVFlinger,
+                      "can't dequeue multiple buffers without setting the buffer count");
+            return Status::InvalidOperation;
+        }
+
+        // See whether a buffer has been queued since the last SetBufferCount so we know whether to
+        // perform the min undequeued buffers check below
+        if (core->buffer_has_been_queued) {
+            // Make sure the producer is not trying to dequeue more buffers than allowed
+            const s32 new_undequeued_count = max_buffer_count - (dequeued_count + 1);
+            const s32 min_undequeued_count = core->GetMinUndequeuedBufferCountLocked(async);
+            if (new_undequeued_count < min_undequeued_count) {
+                LOG_ERROR(Service_NVFlinger,
+                          "min undequeued buffer count({}) exceeded (dequeued={} undequeued={})",
+                          min_undequeued_count, dequeued_count, new_undequeued_count);
+                return Status::InvalidOperation;
+            }
+        }
+
+        // If we disconnect and reconnect quickly, we can be in a state where our slots are empty
+        // but we have many buffers in the queue. This can cause us to run out of memory if we
+        // outrun the consumer. Wait here if it looks like we have too many buffers queued up.
+        const bool too_many_buffers = core->queue.size() > static_cast<size_t>(max_buffer_count);
+        if (too_many_buffers) {
+            LOG_ERROR(Service_NVFlinger, "queue size is {}, waiting", core->queue.size());
+        }
+
+        // If no buffer is found, or if the queue has too many buffers outstanding, wait for a
+        // buffer to be acquired or released, or for the max buffer count to change.
+        try_again = (*found == BufferQueueCore::INVALID_BUFFER_SLOT) || too_many_buffers;
+        if (try_again) {
+            // Return an error if we're in non-blocking mode (producer and consumer are controlled
+            // by the application).
+            if (core->dequeue_buffer_cannot_block &&
+                (acquired_count <= core->max_acquired_buffer_count)) {
+                return Status::WouldBlock;
+            }
+
+            if (!core->WaitForDequeueCondition()) {
+                // We are no longer running
+                return Status::NoError;
+            }
+        }
+    }
+
+    return Status::NoError;
+}
+
+Status BufferQueueProducer::DequeueBuffer(s32* out_slot, Fence* out_fence, bool async, u32 width,
+                                          u32 height, PixelFormat format, u32 usage) {
+    LOG_DEBUG(Service_NVFlinger, "async={} w={} h={} format={}, usage={}", async ? "true" : "false",
+              width, height, format, usage);
+
+    if ((width != 0 && height == 0) || (width == 0 && height != 0)) {
+        LOG_ERROR(Service_NVFlinger, "invalid size: w={} h={}", width, height);
+        return Status::BadValue;
+    }
+
+    Status return_flags = Status::NoError;
+    bool attached_by_consumer = false;
+    {
+        std::scoped_lock lock{core->mutex};
+        core->WaitWhileAllocatingLocked();
+
+        if (format == PixelFormat::NoFormat) {
+            format = core->default_buffer_format;
+        }
+
+        // Enable the usage bits the consumer requested
+        usage |= core->consumer_usage_bit;
+
+        s32 found{};
+        Status status = WaitForFreeSlotThenRelock(async, &found, &return_flags);
+        if (status != Status::NoError) {
+            return status;
+        }
+
+        // This should not happen
+        if (found == BufferQueueCore::INVALID_BUFFER_SLOT) {
+            LOG_ERROR(Service_NVFlinger, "no available buffer slots");
+            return Status::Busy;
+        }
+
+        *out_slot = found;
+
+        attached_by_consumer = slots[found].attached_by_consumer;
+
+        const bool use_default_size = !width && !height;
+        if (use_default_size) {
+            width = core->default_width;
+            height = core->default_height;
+        }
+
+        slots[found].buffer_state = BufferState::Dequeued;
+
+        const std::shared_ptr<GraphicBuffer>& buffer(slots[found].graphic_buffer);
+        if ((buffer == nullptr) || (buffer->Width() != width) || (buffer->Height() != height) ||
+            (buffer->Format() != format) || ((buffer->Usage() & usage) != usage)) {
+            slots[found].acquire_called = false;
+            slots[found].graphic_buffer = nullptr;
+            slots[found].request_buffer_called = false;
+            slots[found].fence = Fence::NoFence();
+
+            return_flags |= Status::BufferNeedsReallocation;
+        }
+
+        *out_fence = slots[found].fence;
+        slots[found].fence = Fence::NoFence();
+    }
+
+    if ((return_flags & Status::BufferNeedsReallocation) != Status::None) {
+        LOG_DEBUG(Service_NVFlinger, "allocating a new buffer for slot {}", *out_slot);
+
+        auto graphic_buffer = std::make_shared<GraphicBuffer>(width, height, format, usage);
+        if (graphic_buffer == nullptr) {
+            LOG_ERROR(Service_NVFlinger, "creating GraphicBuffer failed");
+            return Status::NoMemory;
+        }
+
+        {
+            std::scoped_lock lock{core->mutex};
+
+            if (core->is_abandoned) {
+                LOG_ERROR(Service_NVFlinger, "BufferQueue has been abandoned");
+                return Status::NoInit;
+            }
+
+            slots[*out_slot].frame_number = UINT32_MAX;
+            slots[*out_slot].graphic_buffer = graphic_buffer;
+        }
+    }
+
+    if (attached_by_consumer) {
+        return_flags |= Status::BufferNeedsReallocation;
+    }
+
+    LOG_DEBUG(Service_NVFlinger, "returning slot={} frame={}, flags={}", *out_slot,
+              slots[*out_slot].frame_number, return_flags);
+
+    return return_flags;
+}
+
+Status BufferQueueProducer::DetachBuffer(s32 slot) {
+    LOG_DEBUG(Service_NVFlinger, "slot {}", slot);
+
+    std::scoped_lock lock{core->mutex};
+
+    if (core->is_abandoned) {
+        LOG_ERROR(Service_NVFlinger, "BufferQueue has been abandoned");
+        return Status::NoInit;
+    }
+
+    if (slot < 0 || slot >= BufferQueueDefs::NUM_BUFFER_SLOTS) {
+        LOG_ERROR(Service_NVFlinger, "slot {} out of range [0, {})", slot,
+                  BufferQueueDefs::NUM_BUFFER_SLOTS);
+        return Status::BadValue;
+    } else if (slots[slot].buffer_state != BufferState::Dequeued) {
+        LOG_ERROR(Service_NVFlinger, "slot {} is not owned by the producer (state = {})", slot,
+                  slots[slot].buffer_state);
+        return Status::BadValue;
+    } else if (!slots[slot].request_buffer_called) {
+        LOG_ERROR(Service_NVFlinger, "buffer in slot {} has not been requested", slot);
+        return Status::BadValue;
+    }
+
+    core->FreeBufferLocked(slot);
+    core->SignalDequeueCondition();
+
+    return Status::NoError;
+}
+
+Status BufferQueueProducer::DetachNextBuffer(std::shared_ptr<GraphicBuffer>* out_buffer,
+                                             Fence* out_fence) {
+    if (out_buffer == nullptr) {
+        LOG_ERROR(Service_NVFlinger, "out_buffer must not be nullptr");
+        return Status::BadValue;
+    } else if (out_fence == nullptr) {
+        LOG_ERROR(Service_NVFlinger, "out_fence must not be nullptr");
+        return Status::BadValue;
+    }
+
+    std::scoped_lock lock{core->mutex};
+    core->WaitWhileAllocatingLocked();
+
+    if (core->is_abandoned) {
+        LOG_ERROR(Service_NVFlinger, "BufferQueue has been abandoned");
+        return Status::NoInit;
+    }
+
+    // Find the oldest valid slot
+    int found = BufferQueueCore::INVALID_BUFFER_SLOT;
+    for (int s = 0; s < BufferQueueDefs::NUM_BUFFER_SLOTS; ++s) {
+        if (slots[s].buffer_state == BufferState::Free && slots[s].graphic_buffer != nullptr) {
+            if (found == BufferQueueCore::INVALID_BUFFER_SLOT ||
+                slots[s].frame_number < slots[found].frame_number) {
+                found = s;
+            }
+        }
+    }
+
+    if (found == BufferQueueCore::INVALID_BUFFER_SLOT) {
+        return Status::NoMemory;
+    }
+
+    LOG_DEBUG(Service_NVFlinger, "Detached slot {}", found);
+
+    *out_buffer = slots[found].graphic_buffer;
+    *out_fence = slots[found].fence;
+
+    core->FreeBufferLocked(found);
+
+    return Status::NoError;
+}
+
+Status BufferQueueProducer::AttachBuffer(s32* out_slot,
+                                         const std::shared_ptr<GraphicBuffer>& buffer) {
+    if (out_slot == nullptr) {
+        LOG_ERROR(Service_NVFlinger, "out_slot must not be nullptr");
+        return Status::BadValue;
+    } else if (buffer == nullptr) {
+        LOG_ERROR(Service_NVFlinger, "Cannot attach nullptr buffer");
+        return Status::BadValue;
+    }
+
+    std::scoped_lock lock{core->mutex};
+    core->WaitWhileAllocatingLocked();
+
+    Status return_flags = Status::NoError;
+    s32 found{};
+
+    const auto status = WaitForFreeSlotThenRelock(false, &found, &return_flags);
+    if (status != Status::NoError) {
+        return status;
+    }
+
+    // This should not happen
+    if (found == BufferQueueCore::INVALID_BUFFER_SLOT) {
+        LOG_ERROR(Service_NVFlinger, "No available buffer slots");
+        return Status::Busy;
+    }
+
+    *out_slot = found;
+
+    LOG_DEBUG(Service_NVFlinger, "Returning slot {} flags={}", *out_slot, return_flags);
+
+    slots[*out_slot].graphic_buffer = buffer;
+    slots[*out_slot].buffer_state = BufferState::Dequeued;
+    slots[*out_slot].fence = Fence::NoFence();
+    slots[*out_slot].request_buffer_called = true;
+
+    return return_flags;
+}
+
+Status BufferQueueProducer::QueueBuffer(s32 slot, const QueueBufferInput& input,
+                                        QueueBufferOutput* output) {
+    s64 timestamp{};
+    bool is_auto_timestamp{};
+    Common::Rectangle<s32> crop;
+    NativeWindowScalingMode scaling_mode{};
+    NativeWindowTransform transform;
+    u32 sticky_transform_{};
+    bool async{};
+    s32 swap_interval{};
+    Fence fence{};
+
+    input.Deflate(&timestamp, &is_auto_timestamp, &crop, &scaling_mode, &transform,
+                  &sticky_transform_, &async, &swap_interval, &fence);
+
+    switch (scaling_mode) {
+    case NativeWindowScalingMode::Freeze:
+    case NativeWindowScalingMode::ScaleToWindow:
+    case NativeWindowScalingMode::ScaleCrop:
+    case NativeWindowScalingMode::NoScaleCrop:
+        break;
+    default:
+        LOG_ERROR(Service_NVFlinger, "unknown scaling mode {}", scaling_mode);
+        return Status::BadValue;
+    }
+
+    std::shared_ptr<IConsumerListener> frame_available_listener;
+    std::shared_ptr<IConsumerListener> frame_replaced_listener;
+    s32 callback_ticket{};
+    BufferItem item;
+
+    {
+        std::scoped_lock lock{core->mutex};
+
+        if (core->is_abandoned) {
+            LOG_ERROR(Service_NVFlinger, "BufferQueue has been abandoned");
+            return Status::NoInit;
+        }
+
+        const s32 max_buffer_count = core->GetMaxBufferCountLocked(async);
+        if (async && core->override_max_buffer_count) {
+            if (core->override_max_buffer_count < max_buffer_count) {
+                LOG_ERROR(Service_NVFlinger, "async mode is invalid with "
+                                             "buffer count override");
+                return Status::BadValue;
+            }
+        }
+
+        if (slot < 0 || slot >= max_buffer_count) {
+            LOG_ERROR(Service_NVFlinger, "slot index {} out of range [0, {})", slot,
+                      max_buffer_count);
+            return Status::BadValue;
+        } else if (slots[slot].buffer_state != BufferState::Dequeued) {
+            LOG_ERROR(Service_NVFlinger,
+                      "slot {} is not owned by the producer "
+                      "(state = {})",
+                      slot, slots[slot].buffer_state);
+            return Status::BadValue;
+        } else if (!slots[slot].request_buffer_called) {
+            LOG_ERROR(Service_NVFlinger,
+                      "slot {} was queued without requesting "
+                      "a buffer",
+                      slot);
+            return Status::BadValue;
+        }
+
+        LOG_DEBUG(Service_NVFlinger,
+                  "slot={} frame={} time={} crop=[{},{},{},{}] transform={} scale={}", slot,
+                  core->frame_counter + 1, timestamp, crop.Left(), crop.Top(), crop.Right(),
+                  crop.Bottom(), transform, scaling_mode);
+
+        const std::shared_ptr<GraphicBuffer>& graphic_buffer(slots[slot].graphic_buffer);
+        Common::Rectangle<s32> buffer_rect(graphic_buffer->Width(), graphic_buffer->Height());
+        Common::Rectangle<s32> cropped_rect;
+        [[maybe_unused]] const bool unused = crop.Intersect(buffer_rect, &cropped_rect);
+
+        if (cropped_rect != crop) {
+            LOG_ERROR(Service_NVFlinger, "crop rect is not contained within the buffer in slot {}",
+                      slot);
+            return Status::BadValue;
+        }
+
+        slots[slot].fence = fence;
+        slots[slot].buffer_state = BufferState::Queued;
+        ++core->frame_counter;
+        slots[slot].frame_number = core->frame_counter;
+
+        item.acquire_called = slots[slot].acquire_called;
+        item.graphic_buffer = slots[slot].graphic_buffer;
+        item.crop = crop;
+        item.transform = transform & ~NativeWindowTransform::InverseDisplay;
+        item.transform_to_display_inverse =
+            (transform & NativeWindowTransform::InverseDisplay) != NativeWindowTransform::None;
+        item.scaling_mode = static_cast<u32>(scaling_mode);
+        item.timestamp = timestamp;
+        item.is_auto_timestamp = is_auto_timestamp;
+        item.frame_number = core->frame_counter;
+        item.slot = slot;
+        item.fence = fence;
+        item.is_droppable = core->dequeue_buffer_cannot_block || async;
+        item.swap_interval = swap_interval;
+
+        sticky_transform = sticky_transform_;
+
+        if (core->queue.empty()) {
+            // When the queue is empty, we can simply queue this buffer
+            core->queue.push_back(item);
+            frame_available_listener = core->consumer_listener;
+        } else {
+            // When the queue is not empty, we need to look at the front buffer
+            // state to see if we need to replace it
+            auto front(core->queue.begin());
+
+            if (front->is_droppable) {
+                // If the front queued buffer is still being tracked, we first
+                // mark it as freed
+                if (core->StillTracking(*front)) {
+                    slots[front->slot].buffer_state = BufferState::Free;
+                    // Reset the frame number of the freed buffer so that it is the first in line to
+                    // be dequeued again
+                    slots[front->slot].frame_number = 0;
+                }
+                // Overwrite the droppable buffer with the incoming one
+                *front = item;
+                frame_replaced_listener = core->consumer_listener;
+            } else {
+                core->queue.push_back(item);
+                frame_available_listener = core->consumer_listener;
+            }
+        }
+
+        core->buffer_has_been_queued = true;
+        core->SignalDequeueCondition();
+        output->Inflate(core->default_width, core->default_height, core->transform_hint,
+                        static_cast<u32>(core->queue.size()));
+
+        // Take a ticket for the callback functions
+        callback_ticket = next_callback_ticket++;
+    }
+
+    // Don't send the GraphicBuffer through the callback, and don't send the slot number, since the
+    // consumer shouldn't need it
+    item.graphic_buffer.reset();
+    item.slot = BufferItem::INVALID_BUFFER_SLOT;
+
+    // Call back without the main BufferQueue lock held, but with the callback lock held so we can
+    // ensure that callbacks occur in order
+    {
+        std::scoped_lock lock{callback_mutex};
+        while (callback_ticket != current_callback_ticket) {
+            callback_condition.wait(callback_mutex);
+        }
+
+        if (frame_available_listener != nullptr) {
+            frame_available_listener->OnFrameAvailable(item);
+        } else if (frame_replaced_listener != nullptr) {
+            frame_replaced_listener->OnFrameReplaced(item);
+        }
+
+        ++current_callback_ticket;
+        callback_condition.notify_all();
+    }
+
+    return Status::NoError;
+}
+
+void BufferQueueProducer::CancelBuffer(s32 slot, const Fence& fence) {
+    LOG_DEBUG(Service_NVFlinger, "slot {}", slot);
+
+    std::scoped_lock lock{core->mutex};
+
+    if (core->is_abandoned) {
+        LOG_ERROR(Service_NVFlinger, "BufferQueue has been abandoned");
+        return;
+    }
+
+    if (slot < 0 || slot >= BufferQueueDefs::NUM_BUFFER_SLOTS) {
+        LOG_ERROR(Service_NVFlinger, "slot index {} out of range [0, {})", slot,
+                  BufferQueueDefs::NUM_BUFFER_SLOTS);
+        return;
+    } else if (slots[slot].buffer_state != BufferState::Dequeued) {
+        LOG_ERROR(Service_NVFlinger, "slot {} is not owned by the producer (state = {})", slot,
+                  slots[slot].buffer_state);
+        return;
+    }
+
+    slots[slot].buffer_state = BufferState::Free;
+    slots[slot].frame_number = 0;
+    slots[slot].fence = fence;
+
+    core->SignalDequeueCondition();
+    buffer_wait_event->GetWritableEvent().Signal();
+}
+
+Status BufferQueueProducer::Query(NativeWindow what, s32* out_value) {
+    std::scoped_lock lock{core->mutex};
+
+    if (out_value == nullptr) {
+        LOG_ERROR(Service_NVFlinger, "outValue was nullptr");
+        return Status::BadValue;
+    }
+
+    if (core->is_abandoned) {
+        LOG_ERROR(Service_NVFlinger, "BufferQueue has been abandoned");
+        return Status::NoInit;
+    }
+
+    u32 value{};
+    switch (what) {
+    case NativeWindow::Width:
+        value = core->default_width;
+        break;
+    case NativeWindow::Height:
+        value = core->default_height;
+        break;
+    case NativeWindow::Format:
+        value = static_cast<u32>(core->default_buffer_format);
+        break;
+    case NativeWindow::MinUndequeedBuffers:
+        value = core->GetMinUndequeuedBufferCountLocked(false);
+        break;
+    case NativeWindow::StickyTransform:
+        value = sticky_transform;
+        break;
+    case NativeWindow::ConsumerRunningBehind:
+        value = (core->queue.size() > 1);
+        break;
+    case NativeWindow::ConsumerUsageBits:
+        value = core->consumer_usage_bit;
+        break;
+    default:
+        UNREACHABLE();
+        return Status::BadValue;
+    }
+
+    LOG_DEBUG(Service_NVFlinger, "what = {}, value = {}", what, value);
+
+    *out_value = static_cast<s32>(value);
+
+    return Status::NoError;
+}
+
+Status BufferQueueProducer::Connect(const std::shared_ptr<IProducerListener>& listener,
+                                    NativeWindowApi api, bool producer_controlled_by_app,
+                                    QueueBufferOutput* output) {
+    std::scoped_lock lock{core->mutex};
+
+    LOG_DEBUG(Service_NVFlinger, "api = {} producer_controlled_by_app = {}", api,
+              producer_controlled_by_app);
+
+    if (core->is_abandoned) {
+        LOG_ERROR(Service_NVFlinger, "BufferQueue has been abandoned");
+        return Status::NoInit;
+    }
+
+    if (core->consumer_listener == nullptr) {
+        LOG_ERROR(Service_NVFlinger, "BufferQueue has no consumer");
+        return Status::NoInit;
+    }
+
+    if (output == nullptr) {
+        LOG_ERROR(Service_NVFlinger, "output was nullptr");
+        return Status::BadValue;
+    }
+
+    if (core->connected_api != NativeWindowApi::NoConnectedApi) {
+        LOG_ERROR(Service_NVFlinger, "already connected (cur = {} req = {})", core->connected_api,
+                  api);
+        return Status::BadValue;
+    }
+
+    Status status = Status::NoError;
+    switch (api) {
+    case NativeWindowApi::Egl:
+    case NativeWindowApi::Cpu:
+    case NativeWindowApi::Media:
+    case NativeWindowApi::Camera:
+        core->connected_api = api;
+        output->Inflate(core->default_width, core->default_height, core->transform_hint,
+                        static_cast<u32>(core->queue.size()));
+        core->connected_producer_listener = listener;
+        break;
+    default:
+        LOG_ERROR(Service_NVFlinger, "unknown api = {}", api);
+        status = Status::BadValue;
+        break;
+    }
+
+    core->buffer_has_been_queued = false;
+    core->dequeue_buffer_cannot_block =
+        core->consumer_controlled_by_app && producer_controlled_by_app;
+
+    return status;
+}
+
+Status BufferQueueProducer::Disconnect(NativeWindowApi api) {
+    LOG_DEBUG(Service_NVFlinger, "api = {}", api);
+
+    Status status = Status::NoError;
+    std::shared_ptr<IConsumerListener> listener;
+
+    {
+        std::scoped_lock lock{core->mutex};
+
+        core->WaitWhileAllocatingLocked();
+
+        if (core->is_abandoned) {
+            // Disconnecting after the surface has been abandoned is a no-op.
+            return Status::NoError;
+        }
+
+        switch (api) {
+        case NativeWindowApi::Egl:
+        case NativeWindowApi::Cpu:
+        case NativeWindowApi::Media:
+        case NativeWindowApi::Camera:
+            if (core->connected_api == api) {
+                core->FreeAllBuffersLocked();
+                core->connected_producer_listener = nullptr;
+                core->connected_api = NativeWindowApi::NoConnectedApi;
+                core->SignalDequeueCondition();
+                buffer_wait_event->GetWritableEvent().Signal();
+                listener = core->consumer_listener;
+            } else {
+                LOG_ERROR(Service_NVFlinger, "still connected to another api (cur = {} req = {})",
+                          core->connected_api, api);
+                status = Status::BadValue;
+            }
+            break;
+        default:
+            LOG_ERROR(Service_NVFlinger, "unknown api = {}", api);
+            status = Status::BadValue;
+            break;
+        }
+    }
+
+    // Call back without lock held
+    if (listener != nullptr) {
+        listener->OnBuffersReleased();
+    }
+
+    return status;
+}
+
+Status BufferQueueProducer::SetPreallocatedBuffer(s32 slot,
+                                                  const std::shared_ptr<GraphicBuffer>& buffer) {
+    LOG_DEBUG(Service_NVFlinger, "slot {}", slot);
+
+    if (slot < 0 || slot >= BufferQueueDefs::NUM_BUFFER_SLOTS) {
+        return Status::BadValue;
+    }
+
+    std::scoped_lock lock{core->mutex};
+
+    slots[slot] = {};
+    slots[slot].graphic_buffer = buffer;
+    slots[slot].frame_number = 0;
+
+    // Most games preallocate a buffer and pass a valid buffer here. However, it is possible for
+    // this to be called with an empty buffer, Naruto Ultimate Ninja Storm is a game that does this.
+    if (buffer) {
+        slots[slot].is_preallocated = true;
+
+        core->override_max_buffer_count = core->GetPreallocatedBufferCountLocked();
+        core->default_width = buffer->Width();
+        core->default_height = buffer->Height();
+        core->default_buffer_format = buffer->Format();
+    }
+
+    core->SignalDequeueCondition();
+    buffer_wait_event->GetWritableEvent().Signal();
+
+    return Status::NoError;
+}
+
+void BufferQueueProducer::Transact(Kernel::HLERequestContext& ctx, TransactionId code, u32 flags) {
+    Status status{Status::NoError};
+    Parcel parcel_in{ctx.ReadBuffer()};
+    Parcel parcel_out{};
+
+    switch (code) {
+    case TransactionId::Connect: {
+        const auto enable_listener = parcel_in.Read<bool>();
+        const auto api = parcel_in.Read<NativeWindowApi>();
+        const auto producer_controlled_by_app = parcel_in.Read<bool>();
+
+        UNIMPLEMENTED_IF_MSG(enable_listener, "Listener is unimplemented!");
+
+        std::shared_ptr<IProducerListener> listener;
+        QueueBufferOutput output{};
+
+        status = Connect(listener, api, producer_controlled_by_app, &output);
+
+        parcel_out.Write(output);
+        break;
+    }
+    case TransactionId::SetPreallocatedBuffer: {
+        const auto slot = parcel_in.Read<s32>();
+        const auto buffer = parcel_in.ReadObject<GraphicBuffer>();
+
+        status = SetPreallocatedBuffer(slot, buffer);
+        break;
+    }
+    case TransactionId::DequeueBuffer: {
+        const auto is_async = parcel_in.Read<bool>();
+        const auto width = parcel_in.Read<u32>();
+        const auto height = parcel_in.Read<u32>();
+        const auto pixel_format = parcel_in.Read<PixelFormat>();
+        const auto usage = parcel_in.Read<u32>();
+
+        s32 slot{};
+        Fence fence{};
+
+        status = DequeueBuffer(&slot, &fence, is_async, width, height, pixel_format, usage);
+
+        parcel_out.Write(slot);
+        parcel_out.WriteObject(&fence);
+        break;
+    }
+    case TransactionId::RequestBuffer: {
+        const auto slot = parcel_in.Read<s32>();
+
+        std::shared_ptr<GraphicBuffer> buf;
+
+        status = RequestBuffer(slot, &buf);
+
+        parcel_out.WriteObject(buf);
+        break;
+    }
+    case TransactionId::QueueBuffer: {
+        const auto slot = parcel_in.Read<s32>();
+
+        QueueBufferInput input{parcel_in};
+        QueueBufferOutput output;
+
+        status = QueueBuffer(slot, input, &output);
+
+        parcel_out.Write(output);
+        break;
+    }
+    case TransactionId::Query: {
+        const auto what = parcel_in.Read<NativeWindow>();
+
+        s32 value{};
+
+        status = Query(what, &value);
+
+        parcel_out.Write(value);
+        break;
+    }
+    case TransactionId::CancelBuffer: {
+        const auto slot = parcel_in.Read<s32>();
+        const auto fence = parcel_in.ReadFlattened<Fence>();
+
+        CancelBuffer(slot, fence);
+        break;
+    }
+    case TransactionId::Disconnect: {
+        const auto api = parcel_in.Read<NativeWindowApi>();
+
+        status = Disconnect(api);
+        break;
+    }
+    case TransactionId::DetachBuffer: {
+        const auto slot = parcel_in.Read<s32>();
+
+        status = DetachBuffer(slot);
+        break;
+    }
+    case TransactionId::SetBufferCount: {
+        const auto buffer_count = parcel_in.Read<s32>();
+
+        status = SetBufferCount(buffer_count);
+        break;
+    }
+    case TransactionId::GetBufferHistory:
+        LOG_WARNING(Service_NVFlinger, "(STUBBED) called, transaction=GetBufferHistory");
+        break;
+    default:
+        ASSERT_MSG(false, "Unimplemented TransactionId {}", code);
+        break;
+    }
+
+    parcel_out.Write(status);
+
+    ctx.WriteBuffer(parcel_out.Serialize());
+}
+
+Kernel::KReadableEvent& BufferQueueProducer::GetNativeHandle() {
+    return buffer_wait_event->GetReadableEvent();
+}
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/buffer_queue_producer.h b/src/core/hle/service/nvflinger/buffer_queue_producer.h
new file mode 100644
index 000000000..c4ca68fd3
--- /dev/null
+++ b/src/core/hle/service/nvflinger/buffer_queue_producer.h
@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2014 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/gui/BufferQueueProducer.h
+
+#pragma once
+
+#include <condition_variable>
+#include <memory>
+#include <mutex>
+
+#include "common/common_funcs.h"
+#include "core/hle/service/nvdrv/nvdata.h"
+#include "core/hle/service/nvflinger/binder.h"
+#include "core/hle/service/nvflinger/buffer_queue_defs.h"
+#include "core/hle/service/nvflinger/buffer_slot.h"
+#include "core/hle/service/nvflinger/graphic_buffer_producer.h"
+#include "core/hle/service/nvflinger/pixel_format.h"
+#include "core/hle/service/nvflinger/status.h"
+#include "core/hle/service/nvflinger/window.h"
+
+namespace Kernel {
+class KernelCore;
+class KEvent;
+class KReadableEvent;
+class KWritableEvent;
+} // namespace Kernel
+
+namespace Service::KernelHelpers {
+class ServiceContext;
+} // namespace Service::KernelHelpers
+
+namespace Service::android {
+
+class BufferQueueCore;
+class IProducerListener;
+
+class BufferQueueProducer final : public IBinder {
+public:
+    explicit BufferQueueProducer(Service::KernelHelpers::ServiceContext& service_context_,
+                                 std::shared_ptr<BufferQueueCore> buffer_queue_core_);
+    ~BufferQueueProducer();
+
+    void Transact(Kernel::HLERequestContext& ctx, android::TransactionId code, u32 flags) override;
+
+    Kernel::KReadableEvent& GetNativeHandle() override;
+
+public:
+    Status RequestBuffer(s32 slot, std::shared_ptr<GraphicBuffer>* buf);
+    Status SetBufferCount(s32 buffer_count);
+    Status DequeueBuffer(s32* out_slot, android::Fence* out_fence, bool async, u32 width,
+                         u32 height, PixelFormat format, u32 usage);
+    Status DetachBuffer(s32 slot);
+    Status DetachNextBuffer(std::shared_ptr<GraphicBuffer>* out_buffer, Fence* out_fence);
+    Status AttachBuffer(s32* outSlot, const std::shared_ptr<GraphicBuffer>& buffer);
+    Status QueueBuffer(s32 slot, const QueueBufferInput& input, QueueBufferOutput* output);
+    void CancelBuffer(s32 slot, const Fence& fence);
+    Status Query(NativeWindow what, s32* out_value);
+    Status Connect(const std::shared_ptr<IProducerListener>& listener, NativeWindowApi api,
+                   bool producer_controlled_by_app, QueueBufferOutput* output);
+
+    Status Disconnect(NativeWindowApi api);
+    Status SetPreallocatedBuffer(s32 slot, const std::shared_ptr<GraphicBuffer>& buffer);
+
+private:
+    BufferQueueProducer(const BufferQueueProducer&) = delete;
+
+    Status WaitForFreeSlotThenRelock(bool async, s32* found, Status* return_flags) const;
+
+    Kernel::KEvent* buffer_wait_event{};
+    Service::KernelHelpers::ServiceContext& service_context;
+
+    std::shared_ptr<BufferQueueCore> core;
+    BufferQueueDefs::SlotsType& slots;
+    u32 sticky_transform{};
+    std::mutex callback_mutex;
+    s32 next_callback_ticket{};
+    s32 current_callback_ticket{};
+    std::condition_variable_any callback_condition;
+};
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/buffer_slot.h b/src/core/hle/service/nvflinger/buffer_slot.h
new file mode 100644
index 000000000..e3ea58910
--- /dev/null
+++ b/src/core/hle/service/nvflinger/buffer_slot.h
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2014 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/gui/BufferSlot.h
+
+#pragma once
+
+#include <memory>
+
+#include "common/common_types.h"
+#include "core/hle/service/nvflinger/ui/fence.h"
+
+namespace Service::android {
+
+class GraphicBuffer;
+
+enum class BufferState : u32 {
+    Free = 0,
+    Dequeued = 1,
+    Queued = 2,
+    Acquired = 3,
+};
+
+struct BufferSlot final {
+    constexpr BufferSlot() = default;
+
+    std::shared_ptr<GraphicBuffer> graphic_buffer;
+    BufferState buffer_state{BufferState::Free};
+    bool request_buffer_called{};
+    u64 frame_number{};
+    Fence fence;
+    bool acquire_called{};
+    bool needs_cleanup_on_release{};
+    bool attached_by_consumer{};
+    bool is_preallocated{};
+};
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/buffer_transform_flags.h b/src/core/hle/service/nvflinger/buffer_transform_flags.h
new file mode 100644
index 000000000..e8e6300e3
--- /dev/null
+++ b/src/core/hle/service/nvflinger/buffer_transform_flags.h
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+
+#pragma once
+
+#include "common/common_types.h"
+
+namespace Service::android {
+
+enum class BufferTransformFlags : u32 {
+    /// No transform flags are set
+    Unset = 0x00,
+    /// Flip source image horizontally (around the vertical axis)
+    FlipH = 0x01,
+    /// Flip source image vertically (around the horizontal axis)
+    FlipV = 0x02,
+    /// Rotate source image 90 degrees clockwise
+    Rotate90 = 0x04,
+    /// Rotate source image 180 degrees
+    Rotate180 = 0x03,
+    /// Rotate source image 270 degrees clockwise
+    Rotate270 = 0x07,
+};
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/consumer_base.cpp b/src/core/hle/service/nvflinger/consumer_base.cpp
new file mode 100644
index 000000000..30fc21acc
--- /dev/null
+++ b/src/core/hle/service/nvflinger/consumer_base.cpp
@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2010 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/libs/gui/ConsumerBase.cpp
+
+#include "common/assert.h"
+#include "common/logging/log.h"
+#include "core/hle/service/nvflinger/buffer_item.h"
+#include "core/hle/service/nvflinger/buffer_queue_consumer.h"
+#include "core/hle/service/nvflinger/buffer_queue_core.h"
+#include "core/hle/service/nvflinger/consumer_base.h"
+#include "core/hle/service/nvflinger/ui/graphic_buffer.h"
+
+namespace Service::android {
+
+ConsumerBase::ConsumerBase(std::unique_ptr<BufferQueueConsumer> consumer_)
+    : consumer{std::move(consumer_)} {}
+
+ConsumerBase::~ConsumerBase() {
+    std::scoped_lock lock{mutex};
+
+    ASSERT_MSG(is_abandoned, "consumer is not abandoned!");
+}
+
+void ConsumerBase::Connect(bool controlled_by_app) {
+    consumer->Connect(shared_from_this(), controlled_by_app);
+}
+
+void ConsumerBase::FreeBufferLocked(s32 slot_index) {
+    LOG_DEBUG(Service_NVFlinger, "slot_index={}", slot_index);
+
+    slots[slot_index].graphic_buffer = nullptr;
+    slots[slot_index].fence = Fence::NoFence();
+    slots[slot_index].frame_number = 0;
+}
+
+void ConsumerBase::OnFrameAvailable(const BufferItem& item) {
+    LOG_DEBUG(Service_NVFlinger, "called");
+}
+
+void ConsumerBase::OnFrameReplaced(const BufferItem& item) {
+    LOG_DEBUG(Service_NVFlinger, "called");
+}
+
+void ConsumerBase::OnBuffersReleased() {
+    std::scoped_lock lock{mutex};
+
+    LOG_DEBUG(Service_NVFlinger, "called");
+
+    if (is_abandoned) {
+        // Nothing to do if we're already abandoned.
+        return;
+    }
+
+    u64 mask = 0;
+    consumer->GetReleasedBuffers(&mask);
+    for (int i = 0; i < BufferQueueDefs::NUM_BUFFER_SLOTS; i++) {
+        if (mask & (1ULL << i)) {
+            FreeBufferLocked(i);
+        }
+    }
+}
+
+void ConsumerBase::OnSidebandStreamChanged() {}
+
+Status ConsumerBase::AcquireBufferLocked(BufferItem* item, std::chrono::nanoseconds present_when) {
+    Status err = consumer->AcquireBuffer(item, present_when);
+    if (err != Status::NoError) {
+        return err;
+    }
+
+    if (item->graphic_buffer != nullptr) {
+        slots[item->slot].graphic_buffer = item->graphic_buffer;
+    }
+
+    slots[item->slot].frame_number = item->frame_number;
+    slots[item->slot].fence = item->fence;
+
+    LOG_DEBUG(Service_NVFlinger, "slot={}", item->slot);
+
+    return Status::NoError;
+}
+
+Status ConsumerBase::AddReleaseFenceLocked(s32 slot,
+                                           const std::shared_ptr<GraphicBuffer> graphic_buffer,
+                                           const Fence& fence) {
+    LOG_DEBUG(Service_NVFlinger, "slot={}", slot);
+
+    // If consumer no longer tracks this graphic_buffer, we can safely
+    // drop this fence, as it will never be received by the producer.
+
+    if (!StillTracking(slot, graphic_buffer)) {
+        return Status::NoError;
+    }
+
+    slots[slot].fence = fence;
+
+    return Status::NoError;
+}
+
+Status ConsumerBase::ReleaseBufferLocked(s32 slot,
+                                         const std::shared_ptr<GraphicBuffer> graphic_buffer) {
+    // If consumer no longer tracks this graphic_buffer (we received a new
+    // buffer on the same slot), the buffer producer is definitely no longer
+    // tracking it.
+
+    if (!StillTracking(slot, graphic_buffer)) {
+        return Status::NoError;
+    }
+
+    LOG_DEBUG(Service_NVFlinger, "slot={}", slot);
+    Status err = consumer->ReleaseBuffer(slot, slots[slot].frame_number, slots[slot].fence);
+    if (err == Status::StaleBufferSlot) {
+        FreeBufferLocked(slot);
+    }
+
+    slots[slot].fence = Fence::NoFence();
+
+    return err;
+}
+
+bool ConsumerBase::StillTracking(s32 slot,
+                                 const std::shared_ptr<GraphicBuffer> graphic_buffer) const {
+    if (slot < 0 || slot >= BufferQueueDefs::NUM_BUFFER_SLOTS) {
+        return false;
+    }
+
+    return (slots[slot].graphic_buffer != nullptr &&
+            slots[slot].graphic_buffer->Handle() == graphic_buffer->Handle());
+}
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/consumer_base.h b/src/core/hle/service/nvflinger/consumer_base.h
new file mode 100644
index 000000000..736080e3a
--- /dev/null
+++ b/src/core/hle/service/nvflinger/consumer_base.h
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2010 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/gui/ConsumerBase.h
+
+#pragma once
+
+#include <array>
+#include <chrono>
+#include <memory>
+#include <mutex>
+
+#include "common/common_types.h"
+#include "core/hle/service/nvflinger/buffer_queue_defs.h"
+#include "core/hle/service/nvflinger/consumer_listener.h"
+#include "core/hle/service/nvflinger/status.h"
+
+namespace Service::android {
+
+class BufferItem;
+class BufferQueueConsumer;
+
+class ConsumerBase : public IConsumerListener, public std::enable_shared_from_this<ConsumerBase> {
+public:
+    void Connect(bool controlled_by_app);
+
+protected:
+    explicit ConsumerBase(std::unique_ptr<BufferQueueConsumer> consumer_);
+    virtual ~ConsumerBase();
+
+    virtual void OnFrameAvailable(const BufferItem& item) override;
+    virtual void OnFrameReplaced(const BufferItem& item) override;
+    virtual void OnBuffersReleased() override;
+    virtual void OnSidebandStreamChanged() override;
+
+    void FreeBufferLocked(s32 slot_index);
+    Status AcquireBufferLocked(BufferItem* item, std::chrono::nanoseconds present_when);
+    Status ReleaseBufferLocked(s32 slot, const std::shared_ptr<GraphicBuffer> graphic_buffer);
+    bool StillTracking(s32 slot, const std::shared_ptr<GraphicBuffer> graphic_buffer) const;
+    Status AddReleaseFenceLocked(s32 slot, const std::shared_ptr<GraphicBuffer> graphic_buffer,
+                                 const Fence& fence);
+
+    struct Slot final {
+        std::shared_ptr<GraphicBuffer> graphic_buffer;
+        Fence fence;
+        u64 frame_number{};
+    };
+
+protected:
+    std::array<Slot, BufferQueueDefs::NUM_BUFFER_SLOTS> slots;
+
+    bool is_abandoned{};
+
+    std::unique_ptr<BufferQueueConsumer> consumer;
+
+    mutable std::mutex mutex;
+};
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/consumer_listener.h b/src/core/hle/service/nvflinger/consumer_listener.h
new file mode 100644
index 000000000..b6d1c3e9a
--- /dev/null
+++ b/src/core/hle/service/nvflinger/consumer_listener.h
@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2014 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/gui/IConsumerListener.h
+
+#pragma once
+
+namespace Service::android {
+
+class BufferItem;
+
+/// ConsumerListener is the interface through which the BufferQueue notifies the consumer of events
+/// that the consumer may wish to react to.
+class IConsumerListener {
+public:
+    IConsumerListener() = default;
+    virtual ~IConsumerListener() = default;
+
+    virtual void OnFrameAvailable(const BufferItem& item) = 0;
+    virtual void OnFrameReplaced(const BufferItem& item) = 0;
+    virtual void OnBuffersReleased() = 0;
+    virtual void OnSidebandStreamChanged() = 0;
+};
+
+}; // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/graphic_buffer_producer.cpp b/src/core/hle/service/nvflinger/graphic_buffer_producer.cpp
new file mode 100644
index 000000000..04068827e
--- /dev/null
+++ b/src/core/hle/service/nvflinger/graphic_buffer_producer.cpp
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2010 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/libs/gui/IGraphicBufferProducer.cpp
+
+#include "core/hle/service/nvflinger/graphic_buffer_producer.h"
+#include "core/hle/service/nvflinger/parcel.h"
+
+namespace Service::android {
+
+QueueBufferInput::QueueBufferInput(Parcel& parcel) {
+    parcel.ReadFlattened(*this);
+}
+
+QueueBufferOutput::QueueBufferOutput() = default;
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/graphic_buffer_producer.h b/src/core/hle/service/nvflinger/graphic_buffer_producer.h
new file mode 100644
index 000000000..98d27871c
--- /dev/null
+++ b/src/core/hle/service/nvflinger/graphic_buffer_producer.h
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2010 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/gui/IGraphicBufferProducer.h
+
+#pragma once
+
+#include "common/common_funcs.h"
+#include "common/common_types.h"
+#include "common/math_util.h"
+#include "core/hle/service/nvflinger/ui/fence.h"
+#include "core/hle/service/nvflinger/window.h"
+
+namespace Service::android {
+
+class Parcel;
+
+#pragma pack(push, 1)
+struct QueueBufferInput final {
+    explicit QueueBufferInput(Parcel& parcel);
+
+    void Deflate(s64* timestamp_, bool* is_auto_timestamp_, Common::Rectangle<s32>* crop_,
+                 NativeWindowScalingMode* scaling_mode_, NativeWindowTransform* transform_,
+                 u32* sticky_transform_, bool* async_, s32* swap_interval_, Fence* fence_) const {
+        *timestamp_ = timestamp;
+        *is_auto_timestamp_ = static_cast<bool>(is_auto_timestamp);
+        *crop_ = crop;
+        *scaling_mode_ = scaling_mode;
+        *transform_ = transform;
+        *sticky_transform_ = sticky_transform;
+        *async_ = static_cast<bool>(async);
+        *swap_interval_ = swap_interval;
+        *fence_ = fence;
+    }
+
+private:
+    s64 timestamp{};
+    s32 is_auto_timestamp{};
+    Common::Rectangle<s32> crop{};
+    NativeWindowScalingMode scaling_mode{};
+    NativeWindowTransform transform{};
+    u32 sticky_transform{};
+    s32 async{};
+    s32 swap_interval{};
+    Fence fence{};
+};
+#pragma pack(pop)
+static_assert(sizeof(QueueBufferInput) == 84, "QueueBufferInput has wrong size");
+
+struct QueueBufferOutput final {
+    QueueBufferOutput();
+
+    void Deflate(u32* width_, u32* height_, u32* transform_hint_, u32* num_pending_buffers_) const {
+        *width_ = width;
+        *height_ = height;
+        *transform_hint_ = transform_hint;
+        *num_pending_buffers_ = num_pending_buffers;
+    }
+
+    void Inflate(u32 width_, u32 height_, u32 transform_hint_, u32 num_pending_buffers_) {
+        width = width_;
+        height = height_;
+        transform_hint = transform_hint_;
+        num_pending_buffers = num_pending_buffers_;
+    }
+
+private:
+    u32 width{};
+    u32 height{};
+    u32 transform_hint{};
+    u32 num_pending_buffers{};
+};
+static_assert(sizeof(QueueBufferOutput) == 16, "QueueBufferOutput has wrong size");
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/hos_binder_driver_server.cpp b/src/core/hle/service/nvflinger/hos_binder_driver_server.cpp
new file mode 100644
index 000000000..094ba2542
--- /dev/null
+++ b/src/core/hle/service/nvflinger/hos_binder_driver_server.cpp
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+
+#include <mutex>
+
+#include "common/common_types.h"
+#include "core/hle/service/nvflinger/hos_binder_driver_server.h"
+
+namespace Service::NVFlinger {
+
+HosBinderDriverServer::HosBinderDriverServer(Core::System& system_)
+    : service_context(system_, "HosBinderDriverServer") {}
+
+HosBinderDriverServer::~HosBinderDriverServer() {}
+
+u64 HosBinderDriverServer::RegisterProducer(std::unique_ptr<android::IBinder>&& binder) {
+    std::scoped_lock lk{lock};
+
+    last_id++;
+
+    producers[last_id] = std::move(binder);
+
+    return last_id;
+}
+
+android::IBinder* HosBinderDriverServer::TryGetProducer(u64 id) {
+    std::scoped_lock lk{lock};
+
+    if (auto search = producers.find(id); search != producers.end()) {
+        return search->second.get();
+    }
+
+    return {};
+}
+
+} // namespace Service::NVFlinger
diff --git a/src/core/hle/service/nvflinger/hos_binder_driver_server.h b/src/core/hle/service/nvflinger/hos_binder_driver_server.h
new file mode 100644
index 000000000..cbca87fa0
--- /dev/null
+++ b/src/core/hle/service/nvflinger/hos_binder_driver_server.h
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+
+#pragma once
+
+#include <memory>
+#include <mutex>
+#include <unordered_map>
+
+#include "common/common_types.h"
+#include "core/hle/service/kernel_helpers.h"
+#include "core/hle/service/nvflinger/binder.h"
+
+namespace Core {
+class System;
+}
+
+namespace Service::NVFlinger {
+
+class HosBinderDriverServer final {
+public:
+    explicit HosBinderDriverServer(Core::System& system_);
+    ~HosBinderDriverServer();
+
+    u64 RegisterProducer(std::unique_ptr<android::IBinder>&& binder);
+
+    android::IBinder* TryGetProducer(u64 id);
+
+private:
+    KernelHelpers::ServiceContext service_context;
+
+    std::unordered_map<u64, std::unique_ptr<android::IBinder>> producers;
+    std::mutex lock;
+    u64 last_id{};
+};
+
+} // namespace Service::NVFlinger
diff --git a/src/core/hle/service/nvflinger/nvflinger.cpp b/src/core/hle/service/nvflinger/nvflinger.cpp
index 01e69de30..6fb2cdff1 100644
--- a/src/core/hle/service/nvflinger/nvflinger.cpp
+++ b/src/core/hle/service/nvflinger/nvflinger.cpp
@@ -1,6 +1,5 @@
-// Copyright 2018 yuzu emulator team
-// Licensed under GPLv2 or any later version
-// Refer to the license.txt file included.
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
 
 #include <algorithm>
 #include <optional>
@@ -16,8 +15,11 @@
 #include "core/hle/kernel/k_readable_event.h"
 #include "core/hle/service/nvdrv/devices/nvdisp_disp0.h"
 #include "core/hle/service/nvdrv/nvdrv.h"
-#include "core/hle/service/nvflinger/buffer_queue.h"
+#include "core/hle/service/nvflinger/buffer_item_consumer.h"
+#include "core/hle/service/nvflinger/buffer_queue_core.h"
+#include "core/hle/service/nvflinger/hos_binder_driver_server.h"
 #include "core/hle/service/nvflinger/nvflinger.h"
+#include "core/hle/service/nvflinger/ui/graphic_buffer.h"
 #include "core/hle/service/vi/display/vi_display.h"
 #include "core/hle/service/vi/layer/vi_layer.h"
 #include "video_core/gpu.h"
@@ -53,13 +55,14 @@ void NVFlinger::SplitVSync(std::stop_token stop_token) {
     }
 }
 
-NVFlinger::NVFlinger(Core::System& system_)
-    : system(system_), service_context(system_, "nvflinger") {
-    displays.emplace_back(0, "Default", service_context, system);
-    displays.emplace_back(1, "External", service_context, system);
-    displays.emplace_back(2, "Edid", service_context, system);
-    displays.emplace_back(3, "Internal", service_context, system);
-    displays.emplace_back(4, "Null", service_context, system);
+NVFlinger::NVFlinger(Core::System& system_, HosBinderDriverServer& hos_binder_driver_server_)
+    : system(system_), service_context(system_, "nvflinger"),
+      hos_binder_driver_server(hos_binder_driver_server_) {
+    displays.emplace_back(0, "Default", hos_binder_driver_server, service_context, system);
+    displays.emplace_back(1, "External", hos_binder_driver_server, service_context, system);
+    displays.emplace_back(2, "Edid", hos_binder_driver_server, service_context, system);
+    displays.emplace_back(3, "Internal", hos_binder_driver_server, service_context, system);
+    displays.emplace_back(4, "Null", hos_binder_driver_server, service_context, system);
     guard = std::make_shared<std::mutex>();
 
     // Schedule the screen composition events
@@ -83,12 +86,15 @@ NVFlinger::NVFlinger(Core::System& system_)
 }
 
 NVFlinger::~NVFlinger() {
-    for (auto& buffer_queue : buffer_queues) {
-        buffer_queue->Disconnect();
-    }
     if (!system.IsMulticore()) {
         system.CoreTiming().UnscheduleEvent(composition_event, 0);
     }
+
+    for (auto& display : displays) {
+        for (size_t layer = 0; layer < display.GetNumLayers(); ++layer) {
+            display.GetLayer(layer).Core().NotifyShutdown();
+        }
+    }
 }
 
 void NVFlinger::SetNVDrvInstance(std::shared_ptr<Nvidia::Module> instance) {
@@ -98,7 +104,7 @@ void NVFlinger::SetNVDrvInstance(std::shared_ptr<Nvidia::Module> instance) {
 std::optional<u64> NVFlinger::OpenDisplay(std::string_view name) {
     const auto lock_guard = Lock();
 
-    LOG_DEBUG(Service, "Opening \"{}\" display", name);
+    LOG_DEBUG(Service_NVFlinger, "Opening \"{}\" display", name);
 
     const auto itr =
         std::find_if(displays.begin(), displays.end(),
@@ -125,10 +131,8 @@ std::optional<u64> NVFlinger::CreateLayer(u64 display_id) {
 }
 
 void NVFlinger::CreateLayerAtId(VI::Display& display, u64 layer_id) {
-    const u32 buffer_queue_id = next_buffer_queue_id++;
-    buffer_queues.emplace_back(
-        std::make_unique<BufferQueue>(system.Kernel(), buffer_queue_id, layer_id, service_context));
-    display.CreateLayer(layer_id, *buffer_queues.back());
+    const auto buffer_id = next_buffer_queue_id++;
+    display.CreateLayer(layer_id, buffer_id);
 }
 
 void NVFlinger::CloseLayer(u64 layer_id) {
@@ -147,7 +151,7 @@ std::optional<u32> NVFlinger::FindBufferQueueId(u64 display_id, u64 layer_id) {
         return std::nullopt;
     }
 
-    return layer->GetBufferQueue().GetId();
+    return layer->GetBinderId();
 }
 
 Kernel::KReadableEvent* NVFlinger::FindVsyncEvent(u64 display_id) {
@@ -161,18 +165,6 @@ Kernel::KReadableEvent* NVFlinger::FindVsyncEvent(u64 display_id) {
     return &display->GetVSyncEvent();
 }
 
-BufferQueue* NVFlinger::FindBufferQueue(u32 id) {
-    const auto lock_guard = Lock();
-    const auto itr = std::find_if(buffer_queues.begin(), buffer_queues.end(),
-                                  [id](const auto& queue) { return queue->GetId() == id; });
-
-    if (itr == buffer_queues.end()) {
-        return nullptr;
-    }
-
-    return itr->get();
-}
-
 VI::Display* NVFlinger::FindDisplay(u64 display_id) {
     const auto itr =
         std::find_if(displays.begin(), displays.end(),
@@ -227,7 +219,7 @@ VI::Layer* NVFlinger::FindOrCreateLayer(u64 display_id, u64 layer_id) {
     auto* layer = display->FindLayer(layer_id);
 
     if (layer == nullptr) {
-        LOG_DEBUG(Service, "Layer at id {} not found. Trying to create it.", layer_id);
+        LOG_DEBUG(Service_NVFlinger, "Layer at id {} not found. Trying to create it.", layer_id);
         CreateLayerAtId(*display, layer_id);
         return display->FindLayer(layer_id);
     }
@@ -246,23 +238,22 @@ void NVFlinger::Compose() {
 
         // TODO(Subv): Support more than 1 layer.
         VI::Layer& layer = display.GetLayer(0);
-        auto& buffer_queue = layer.GetBufferQueue();
 
-        // Search for a queued buffer and acquire it
-        auto buffer = buffer_queue.AcquireBuffer();
+        android::BufferItem buffer{};
+        const auto status = layer.GetConsumer().AcquireBuffer(&buffer, {}, false);
 
-        if (!buffer) {
+        if (status != android::Status::NoError) {
             continue;
         }
 
-        const auto& igbp_buffer = buffer->get().igbp_buffer;
+        const auto& igbp_buffer = *buffer.graphic_buffer;
 
         if (!system.IsPoweredOn()) {
             return; // We are likely shutting down
         }
 
         auto& gpu = system.GPU();
-        const auto& multi_fence = buffer->get().multi_fence;
+        const auto& multi_fence = buffer.fence;
         guard->unlock();
         for (u32 fence_id = 0; fence_id < multi_fence.num_fences; fence_id++) {
             const auto& fence = multi_fence.fences[fence_id];
@@ -278,12 +269,18 @@ void NVFlinger::Compose() {
         auto nvdisp = nvdrv->GetDevice<Nvidia::Devices::nvdisp_disp0>("/dev/nvdisp_disp0");
         ASSERT(nvdisp);
 
-        nvdisp->flip(igbp_buffer.gpu_buffer_id, igbp_buffer.offset, igbp_buffer.external_format,
-                     igbp_buffer.width, igbp_buffer.height, igbp_buffer.stride,
-                     buffer->get().transform, buffer->get().crop_rect);
+        Common::Rectangle<int> crop_rect{
+            static_cast<int>(buffer.crop.Left()), static_cast<int>(buffer.crop.Top()),
+            static_cast<int>(buffer.crop.Right()), static_cast<int>(buffer.crop.Bottom())};
+
+        nvdisp->flip(igbp_buffer.BufferId(), igbp_buffer.Offset(), igbp_buffer.ExternalFormat(),
+                     igbp_buffer.Width(), igbp_buffer.Height(), igbp_buffer.Stride(),
+                     static_cast<android::BufferTransformFlags>(buffer.transform), crop_rect);
+
+        swap_interval = buffer.swap_interval;
 
-        swap_interval = buffer->get().swap_interval;
-        buffer_queue.ReleaseBuffer(buffer->get().slot);
+        auto fence = android::Fence::NoFence();
+        layer.GetConsumer().ReleaseBuffer(buffer, fence);
     }
 }
 
diff --git a/src/core/hle/service/nvflinger/nvflinger.h b/src/core/hle/service/nvflinger/nvflinger.h
index 7935cf773..ed160f6f9 100644
--- a/src/core/hle/service/nvflinger/nvflinger.h
+++ b/src/core/hle/service/nvflinger/nvflinger.h
@@ -1,6 +1,5 @@
-// Copyright 2018 yuzu emulator team
-// Licensed under GPLv2 or any later version
-// Refer to the license.txt file included.
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
 
 #pragma once
 
@@ -37,13 +36,16 @@ class Display;
 class Layer;
 } // namespace Service::VI
 
-namespace Service::NVFlinger {
+namespace Service::android {
+class BufferQueueCore;
+class BufferQueueProducer;
+} // namespace Service::android
 
-class BufferQueue;
+namespace Service::NVFlinger {
 
 class NVFlinger final {
 public:
-    explicit NVFlinger(Core::System& system_);
+    explicit NVFlinger(Core::System& system_, HosBinderDriverServer& hos_binder_driver_server_);
     ~NVFlinger();
 
     /// Sets the NVDrv module instance to use to send buffers to the GPU.
@@ -72,9 +74,6 @@ public:
     /// If an invalid display ID is provided, then nullptr is returned.
     [[nodiscard]] Kernel::KReadableEvent* FindVsyncEvent(u64 display_id);
 
-    /// Obtains a buffer queue identified by the ID.
-    [[nodiscard]] BufferQueue* FindBufferQueue(u32 id);
-
     /// Performs a composition request to the emulated nvidia GPU and triggers the vsync events when
     /// finished.
     void Compose();
@@ -82,6 +81,12 @@ public:
     [[nodiscard]] s64 GetNextTicks() const;
 
 private:
+    struct Layer {
+        std::unique_ptr<android::BufferQueueCore> core;
+        std::unique_ptr<android::BufferQueueProducer> producer;
+    };
+
+private:
     [[nodiscard]] std::unique_lock<std::mutex> Lock() const {
         return std::unique_lock{*guard};
     }
@@ -111,7 +116,6 @@ private:
     std::shared_ptr<Nvidia::Module> nvdrv;
 
     std::list<VI::Display> displays;
-    std::vector<std::unique_ptr<BufferQueue>> buffer_queues;
 
     /// Id to use for the next layer that is created, this counter is shared among all displays.
     u64 next_layer_id = 1;
@@ -131,6 +135,8 @@ private:
     std::jthread vsync_thread;
 
     KernelHelpers::ServiceContext service_context;
+
+    HosBinderDriverServer& hos_binder_driver_server;
 };
 
 } // namespace Service::NVFlinger
diff --git a/src/core/hle/service/nvflinger/parcel.h b/src/core/hle/service/nvflinger/parcel.h
new file mode 100644
index 000000000..aa36e6479
--- /dev/null
+++ b/src/core/hle/service/nvflinger/parcel.h
@@ -0,0 +1,172 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+
+#pragma once
+
+#include <memory>
+#include <vector>
+
+#include "common/alignment.h"
+#include "common/assert.h"
+#include "common/common_types.h"
+
+namespace Service::android {
+
+class Parcel final {
+public:
+    static constexpr std::size_t DefaultBufferSize = 0x40;
+
+    Parcel() : buffer(DefaultBufferSize) {}
+
+    template <typename T>
+    explicit Parcel(const T& out_data) : buffer(DefaultBufferSize) {
+        Write(out_data);
+    }
+
+    explicit Parcel(std::vector<u8> in_data) : buffer(std::move(in_data)) {
+        DeserializeHeader();
+        [[maybe_unused]] const std::u16string token = ReadInterfaceToken();
+    }
+
+    template <typename T>
+    void Read(T& val) {
+        static_assert(std::is_trivially_copyable_v<T>, "T must be trivially copyable.");
+        ASSERT(read_index + sizeof(T) <= buffer.size());
+
+        std::memcpy(&val, buffer.data() + read_index, sizeof(T));
+        read_index += sizeof(T);
+        read_index = Common::AlignUp(read_index, 4);
+    }
+
+    template <typename T>
+    T Read() {
+        T val;
+        Read(val);
+        return val;
+    }
+
+    template <typename T>
+    void ReadFlattened(T& val) {
+        const auto flattened_size = Read<s64>();
+        ASSERT(sizeof(T) == flattened_size);
+        Read(val);
+    }
+
+    template <typename T>
+    T ReadFlattened() {
+        T val;
+        ReadFlattened(val);
+        return val;
+    }
+
+    template <typename T>
+    T ReadUnaligned() {
+        static_assert(std::is_trivially_copyable_v<T>, "T must be trivially copyable.");
+        ASSERT(read_index + sizeof(T) <= buffer.size());
+
+        T val;
+        std::memcpy(&val, buffer.data() + read_index, sizeof(T));
+        read_index += sizeof(T);
+        return val;
+    }
+
+    template <typename T>
+    const std::shared_ptr<T> ReadObject() {
+        static_assert(std::is_trivially_copyable_v<T>, "T must be trivially copyable.");
+
+        const auto is_valid{Read<bool>()};
+
+        if (is_valid) {
+            auto result = std::make_shared<T>();
+            ReadFlattened(*result);
+            return result;
+        }
+
+        return {};
+    }
+
+    std::u16string ReadInterfaceToken() {
+        [[maybe_unused]] const u32 unknown = Read<u32>();
+        const u32 length = Read<u32>();
+
+        std::u16string token;
+        token.reserve(length + 1);
+
+        for (u32 ch = 0; ch < length + 1; ++ch) {
+            token.push_back(ReadUnaligned<u16>());
+        }
+
+        read_index = Common::AlignUp(read_index, 4);
+
+        return token;
+    }
+
+    template <typename T>
+    void Write(const T& val) {
+        static_assert(std::is_trivially_copyable_v<T>, "T must be trivially copyable.");
+
+        if (buffer.size() < write_index + sizeof(T)) {
+            buffer.resize(buffer.size() + sizeof(T) + DefaultBufferSize);
+        }
+
+        std::memcpy(buffer.data() + write_index, &val, sizeof(T));
+        write_index += sizeof(T);
+        write_index = Common::AlignUp(write_index, 4);
+    }
+
+    template <typename T>
+    void WriteObject(const T* ptr) {
+        static_assert(std::is_trivially_copyable_v<T>, "T must be trivially copyable.");
+
+        if (!ptr) {
+            Write<u32>(0);
+            return;
+        }
+
+        Write<u32>(1);
+        Write<s64>(sizeof(T));
+        Write(*ptr);
+    }
+
+    template <typename T>
+    void WriteObject(const std::shared_ptr<T> ptr) {
+        WriteObject(ptr.get());
+    }
+
+    void DeserializeHeader() {
+        ASSERT(buffer.size() > sizeof(Header));
+
+        Header header{};
+        std::memcpy(&header, buffer.data(), sizeof(Header));
+
+        read_index = header.data_offset;
+    }
+
+    std::vector<u8> Serialize() const {
+        ASSERT(read_index == 0);
+
+        Header header{};
+        header.data_size = static_cast<u32>(write_index - sizeof(Header));
+        header.data_offset = sizeof(Header);
+        header.objects_size = 4;
+        header.objects_offset = static_cast<u32>(sizeof(Header) + header.data_size);
+        std::memcpy(buffer.data(), &header, sizeof(Header));
+
+        return buffer;
+    }
+
+private:
+    struct Header {
+        u32 data_size;
+        u32 data_offset;
+        u32 objects_size;
+        u32 objects_offset;
+    };
+    static_assert(sizeof(Header) == 16, "ParcelHeader has wrong size");
+
+    mutable std::vector<u8> buffer;
+    std::size_t read_index = 0;
+    std::size_t write_index = sizeof(Header);
+};
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/pixel_format.h b/src/core/hle/service/nvflinger/pixel_format.h
new file mode 100644
index 000000000..8a77d8bea
--- /dev/null
+++ b/src/core/hle/service/nvflinger/pixel_format.h
@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+
+#pragma once
+
+#include "common/common_types.h"
+
+namespace Service::android {
+
+enum class PixelFormat : u32 {
+    NoFormat = 0,
+    Rgba8888 = 1,
+    Rgbx8888 = 2,
+    Rgb888 = 3,
+    Rgb565 = 4,
+    Bgra8888 = 5,
+    Rgba5551 = 6,
+    Rgba4444 = 7,
+};
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/producer_listener.h b/src/core/hle/service/nvflinger/producer_listener.h
new file mode 100644
index 000000000..468e06431
--- /dev/null
+++ b/src/core/hle/service/nvflinger/producer_listener.h
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2014 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/gui/IProducerListener.h
+
+#pragma once
+
+namespace Service::android {
+
+class IProducerListener {
+public:
+    virtual void OnBufferReleased() = 0;
+};
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/status.h b/src/core/hle/service/nvflinger/status.h
new file mode 100644
index 000000000..a003eda89
--- /dev/null
+++ b/src/core/hle/service/nvflinger/status.h
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+
+#pragma once
+
+#include "common/common_funcs.h"
+#include "common/common_types.h"
+
+namespace Service::android {
+
+enum class Status : s32 {
+    None = 0,
+    NoError = 0,
+    StaleBufferSlot = 1,
+    NoBufferAvailable = 2,
+    PresentLater = 3,
+    WouldBlock = -11,
+    NoMemory = -12,
+    Busy = -16,
+    NoInit = -19,
+    BadValue = -22,
+    InvalidOperation = -37,
+    BufferNeedsReallocation = 1,
+    ReleaseAllBuffers = 2,
+};
+DECLARE_ENUM_FLAG_OPERATORS(Status);
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/ui/fence.h b/src/core/hle/service/nvflinger/ui/fence.h
new file mode 100644
index 000000000..4a74e26a3
--- /dev/null
+++ b/src/core/hle/service/nvflinger/ui/fence.h
@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2012 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/ui/Fence.h
+
+#pragma once
+
+#include <array>
+
+#include "common/common_types.h"
+#include "core/hle/service/nvdrv/nvdata.h"
+
+namespace Service::android {
+
+class Fence {
+public:
+    constexpr Fence() = default;
+
+    static constexpr Fence NoFence() {
+        Fence fence;
+        fence.fences[0].id = -1;
+        return fence;
+    }
+
+public:
+    u32 num_fences{};
+    std::array<Service::Nvidia::NvFence, 4> fences{};
+};
+static_assert(sizeof(Fence) == 36, "Fence has wrong size");
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/ui/graphic_buffer.h b/src/core/hle/service/nvflinger/ui/graphic_buffer.h
new file mode 100644
index 000000000..7abbf78ba
--- /dev/null
+++ b/src/core/hle/service/nvflinger/ui/graphic_buffer.h
@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+// Copyright 2007 The Android Open Source Project
+// Parts of this implementation were base on:
+// https://cs.android.com/android/platform/superproject/+/android-5.1.1_r38:frameworks/native/include/ui/GraphicBuffer.h
+
+#pragma once
+
+#include "common/common_funcs.h"
+#include "common/common_types.h"
+#include "core/hle/service/nvflinger/pixel_format.h"
+
+namespace Service::android {
+
+class GraphicBuffer final {
+public:
+    constexpr GraphicBuffer() = default;
+
+    constexpr GraphicBuffer(u32 width_, u32 height_, PixelFormat format_, u32 usage_)
+        : width{static_cast<s32>(width_)}, height{static_cast<s32>(height_)}, format{format_},
+          usage{static_cast<s32>(usage_)} {}
+
+    constexpr u32 Width() const {
+        return static_cast<u32>(width);
+    }
+
+    constexpr u32 Height() const {
+        return static_cast<u32>(height);
+    }
+
+    constexpr u32 Stride() const {
+        return static_cast<u32>(stride);
+    }
+
+    constexpr u32 Usage() const {
+        return static_cast<u32>(usage);
+    }
+
+    constexpr PixelFormat Format() const {
+        return format;
+    }
+
+    constexpr u32 BufferId() const {
+        return buffer_id;
+    }
+
+    constexpr PixelFormat ExternalFormat() const {
+        return external_format;
+    }
+
+    constexpr u32 Handle() const {
+        return handle;
+    }
+
+    constexpr u32 Offset() const {
+        return offset;
+    }
+
+    constexpr bool NeedsReallocation(u32 width_, u32 height_, PixelFormat format_,
+                                     u32 usage_) const {
+        if (static_cast<s32>(width_) != width) {
+            return true;
+        }
+
+        if (static_cast<s32>(height_) != height) {
+            return true;
+        }
+
+        if (format_ != format) {
+            return true;
+        }
+
+        if ((static_cast<u32>(usage) & usage_) != usage_) {
+            return true;
+        }
+
+        return false;
+    }
+
+private:
+    u32 magic{};
+    s32 width{};
+    s32 height{};
+    s32 stride{};
+    PixelFormat format{};
+    s32 usage{};
+    INSERT_PADDING_WORDS(1);
+    u32 index{};
+    INSERT_PADDING_WORDS(3);
+    u32 buffer_id{};
+    INSERT_PADDING_WORDS(6);
+    PixelFormat external_format{};
+    INSERT_PADDING_WORDS(10);
+    u32 handle{};
+    u32 offset{};
+    INSERT_PADDING_WORDS(60);
+};
+static_assert(sizeof(GraphicBuffer) == 0x16C, "GraphicBuffer has wrong size");
+
+} // namespace Service::android
diff --git a/src/core/hle/service/nvflinger/window.h b/src/core/hle/service/nvflinger/window.h
new file mode 100644
index 000000000..e26f8160e
--- /dev/null
+++ b/src/core/hle/service/nvflinger/window.h
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright 2021 yuzu Emulator Project
+
+#pragma once
+
+#include "common/common_funcs.h"
+#include "common/common_types.h"
+
+namespace Service::android {
+
+/// Attributes queryable with Query
+enum class NativeWindow : s32 {
+    Width = 0,
+    Height = 1,
+    Format = 2,
+    MinUndequeedBuffers = 3,
+    QueuesToWindowComposer = 4,
+    ConcreteType = 5,
+    DefaultWidth = 6,
+    DefaultHeight = 7,
+    TransformHint = 8,
+    ConsumerRunningBehind = 9,
+    ConsumerUsageBits = 10,
+    StickyTransform = 11,
+    DefaultDataSpace = 12,
+    BufferAge = 13,
+};
+
+/// Parameter for Connect/Disconnect
+enum class NativeWindowApi : s32 {
+    NoConnectedApi = 0,
+    Egl = 1,
+    Cpu = 2,
+    Media = 3,
+    Camera = 4,
+};
+
+/// Scaling mode parameter for QueueBuffer
+enum class NativeWindowScalingMode : s32 {
+    Freeze = 0,
+    ScaleToWindow = 1,
+    ScaleCrop = 2,
+    NoScaleCrop = 3,
+};
+
+/// Transform parameter for QueueBuffer
+enum class NativeWindowTransform : u32 {
+    None = 0x0,
+    InverseDisplay = 0x08,
+};
+DECLARE_ENUM_FLAG_OPERATORS(NativeWindowTransform);
+
+} // namespace Service::android
diff --git a/src/core/hle/service/service.cpp b/src/core/hle/service/service.cpp
index eb1138313..0f59a03c5 100644
--- a/src/core/hle/service/service.cpp
+++ b/src/core/hle/service/service.cpp
@@ -32,6 +32,7 @@
 #include "core/hle/service/glue/glue.h"
 #include "core/hle/service/grc/grc.h"
 #include "core/hle/service/hid/hid.h"
+#include "core/hle/service/jit/jit.h"
 #include "core/hle/service/lbl/lbl.h"
 #include "core/hle/service/ldn/ldn.h"
 #include "core/hle/service/ldr/ldr.h"
@@ -49,6 +50,7 @@
 #include "core/hle/service/npns/npns.h"
 #include "core/hle/service/ns/ns.h"
 #include "core/hle/service/nvdrv/nvdrv.h"
+#include "core/hle/service/nvflinger/hos_binder_driver_server.h"
 #include "core/hle/service/nvflinger/nvflinger.h"
 #include "core/hle/service/olsc/olsc.h"
 #include "core/hle/service/pcie/pcie.h"
@@ -90,8 +92,9 @@ namespace Service {
 }
 
 ServiceFrameworkBase::ServiceFrameworkBase(Core::System& system_, const char* service_name_,
-                                           u32 max_sessions_, InvokerFn* handler_invoker_)
-    : SessionRequestHandler(system_.Kernel(), service_name_), system{system_},
+                                           ServiceThreadType thread_type, u32 max_sessions_,
+                                           InvokerFn* handler_invoker_)
+    : SessionRequestHandler(system_.Kernel(), service_name_, thread_type), system{system_},
       service_name{service_name_}, max_sessions{max_sessions_}, handler_invoker{handler_invoker_} {}
 
 ServiceFrameworkBase::~ServiceFrameworkBase() {
@@ -230,7 +233,8 @@ ResultCode ServiceFrameworkBase::HandleSyncRequest(Kernel::KServerSession& sessi
 
 /// Initialize Services
 Services::Services(std::shared_ptr<SM::ServiceManager>& sm, Core::System& system)
-    : nv_flinger{std::make_unique<NVFlinger::NVFlinger>(system)} {
+    : hos_binder_driver_server{std::make_unique<NVFlinger::HosBinderDriverServer>(system)},
+      nv_flinger{std::make_unique<NVFlinger::NVFlinger>(system, *hos_binder_driver_server)} {
 
     // NVFlinger needs to be accessed by several services like Vi and AppletOE so we instantiate it
     // here and pass it into the respective InstallInterfaces functions.
@@ -259,6 +263,7 @@ Services::Services(std::shared_ptr<SM::ServiceManager>& sm, Core::System& system
     Glue::InstallInterfaces(system);
     GRC::InstallInterfaces(*sm, system);
     HID::InstallInterfaces(*sm, system);
+    JIT::InstallInterfaces(*sm, system);
     LBL::InstallInterfaces(*sm, system);
     LDN::InstallInterfaces(*sm, system);
     LDR::InstallInterfaces(*sm, system);
@@ -290,7 +295,7 @@ Services::Services(std::shared_ptr<SM::ServiceManager>& sm, Core::System& system
     SSL::InstallInterfaces(*sm, system);
     Time::InstallInterfaces(system);
     USB::InstallInterfaces(*sm, system);
-    VI::InstallInterfaces(*sm, system, *nv_flinger);
+    VI::InstallInterfaces(*sm, system, *nv_flinger, *hos_binder_driver_server);
     WLAN::InstallInterfaces(*sm, system);
 }
 
diff --git a/src/core/hle/service/service.h b/src/core/hle/service/service.h
index c9d6b879d..c78b2baeb 100644
--- a/src/core/hle/service/service.h
+++ b/src/core/hle/service/service.h
@@ -33,8 +33,9 @@ class FileSystemController;
 }
 
 namespace NVFlinger {
+class HosBinderDriverServer;
 class NVFlinger;
-}
+} // namespace NVFlinger
 
 namespace SM {
 class ServiceManager;
@@ -113,7 +114,8 @@ private:
                            Kernel::HLERequestContext& ctx);
 
     explicit ServiceFrameworkBase(Core::System& system_, const char* service_name_,
-                                  u32 max_sessions_, InvokerFn* handler_invoker_);
+                                  ServiceThreadType thread_type, u32 max_sessions_,
+                                  InvokerFn* handler_invoker_);
     ~ServiceFrameworkBase() override;
 
     void RegisterHandlersBase(const FunctionInfoBase* functions, std::size_t n);
@@ -175,14 +177,17 @@ protected:
     /**
      * Initializes the handler with no functions installed.
      *
-     * @param system_       The system context to construct this service under.
+     * @param system_ The system context to construct this service under.
      * @param service_name_ Name of the service.
-     * @param max_sessions_ Maximum number of sessions that can be
-     *                      connected to this service at the same time.
+     * @param thread_type Specifies the thread type for this service. If this is set to CreateNew,
+     *                    it creates a new thread for it, otherwise this uses the default thread.
+     * @param max_sessions_ Maximum number of sessions that can be connected to this service at the
+     * same time.
      */
     explicit ServiceFramework(Core::System& system_, const char* service_name_,
+                              ServiceThreadType thread_type = ServiceThreadType::Default,
                               u32 max_sessions_ = ServerSessionCountMax)
-        : ServiceFrameworkBase(system_, service_name_, max_sessions_, Invoker) {}
+        : ServiceFrameworkBase(system_, service_name_, thread_type, max_sessions_, Invoker) {}
 
     /// Registers handlers in the service.
     template <std::size_t N>
@@ -236,6 +241,7 @@ public:
     ~Services();
 
 private:
+    std::unique_ptr<NVFlinger::HosBinderDriverServer> hos_binder_driver_server;
     std::unique_ptr<NVFlinger::NVFlinger> nv_flinger;
 };
 
diff --git a/src/core/hle/service/sm/sm.cpp b/src/core/hle/service/sm/sm.cpp
index eaa172595..13f5e08ec 100644
--- a/src/core/hle/service/sm/sm.cpp
+++ b/src/core/hle/service/sm/sm.cpp
@@ -81,6 +81,8 @@ ResultVal<Kernel::KPort*> ServiceManager::GetServicePort(const std::string& name
     }
 
     auto* port = Kernel::KPort::Create(kernel);
+    SCOPE_EXIT({ port->Close(); });
+
     port->Initialize(ServerSessionCountMax, false, name);
     auto handler = it->second;
     port->GetServerPort().SetSessionHandler(std::move(handler));
@@ -151,7 +153,7 @@ ResultVal<Kernel::KClientSession*> SM::GetServiceImpl(Kernel::HLERequestContext&
     auto& port = port_result.Unwrap();
     SCOPE_EXIT({ port->GetClientPort().Close(); });
 
-    server_ports.emplace_back(&port->GetServerPort());
+    kernel.RegisterServerObject(&port->GetServerPort());
 
     // Create a new session.
     Kernel::KClientSession* session{};
@@ -204,7 +206,7 @@ void SM::UnregisterService(Kernel::HLERequestContext& ctx) {
 }
 
 SM::SM(ServiceManager& service_manager_, Core::System& system_)
-    : ServiceFramework{system_, "sm:", 4},
+    : ServiceFramework{system_, "sm:", ServiceThreadType::Default, 4},
       service_manager{service_manager_}, kernel{system_.Kernel()} {
     RegisterHandlers({
         {0, &SM::Initialize, "Initialize"},
@@ -222,10 +224,6 @@ SM::SM(ServiceManager& service_manager_, Core::System& system_)
     });
 }
 
-SM::~SM() {
-    for (auto& server_port : server_ports) {
-        server_port->Close();
-    }
-}
+SM::~SM() = default;
 
 } // namespace Service::SM
diff --git a/src/core/hle/service/sm/sm.h b/src/core/hle/service/sm/sm.h
index 021eb51b4..f3ff7b27e 100644
--- a/src/core/hle/service/sm/sm.h
+++ b/src/core/hle/service/sm/sm.h
@@ -22,7 +22,6 @@ class KClientPort;
 class KClientSession;
 class KernelCore;
 class KPort;
-class KServerPort;
 class SessionRequestHandler;
 } // namespace Kernel
 
@@ -48,7 +47,6 @@ private:
     ServiceManager& service_manager;
     bool is_initialized{};
     Kernel::KernelCore& kernel;
-    std::vector<Kernel::KServerPort*> server_ports;
 };
 
 class ServiceManager {
diff --git a/src/core/hle/service/sockets/bsd.cpp b/src/core/hle/service/sockets/bsd.cpp
index f83272633..d25b050e2 100644
--- a/src/core/hle/service/sockets/bsd.cpp
+++ b/src/core/hle/service/sockets/bsd.cpp
@@ -10,7 +10,6 @@
 #include <fmt/format.h>
 
 #include "common/microprofile.h"
-#include "common/thread.h"
 #include "core/hle/ipc_helpers.h"
 #include "core/hle/kernel/k_thread.h"
 #include "core/hle/service/sockets/bsd.h"
@@ -569,9 +568,9 @@ std::pair<s32, Errno> BSD::AcceptImpl(s32 fd, std::vector<u8>& write_buffer) {
     new_descriptor.socket = std::move(result.socket);
     new_descriptor.is_connection_based = descriptor.is_connection_based;
 
-    ASSERT(write_buffer.size() == sizeof(SockAddrIn));
     const SockAddrIn guest_addr_in = Translate(result.sockaddr_in);
-    std::memcpy(write_buffer.data(), &guest_addr_in, sizeof(guest_addr_in));
+    const size_t length = std::min(sizeof(guest_addr_in), write_buffer.size());
+    std::memcpy(write_buffer.data(), &guest_addr_in, length);
 
     return {new_fd, Errno::SUCCESS};
 }
@@ -690,6 +689,9 @@ Errno BSD::SetSockOptImpl(s32 fd, u32 level, OptName optname, size_t optlen, con
     case OptName::REUSEADDR:
         ASSERT(value == 0 || value == 1);
         return Translate(socket->SetReuseAddr(value != 0));
+    case OptName::KEEPALIVE:
+        ASSERT(value == 0 || value == 1);
+        return Translate(socket->SetKeepAlive(value != 0));
     case OptName::BROADCAST:
         ASSERT(value == 0 || value == 1);
         return Translate(socket->SetBroadcast(value != 0));
@@ -838,7 +840,8 @@ void BSD::BuildErrnoResponse(Kernel::HLERequestContext& ctx, Errno bsd_errno) co
     rb.PushEnum(bsd_errno);
 }
 
-BSD::BSD(Core::System& system_, const char* name) : ServiceFramework{system_, name} {
+BSD::BSD(Core::System& system_, const char* name)
+    : ServiceFramework{system_, name, ServiceThreadType::CreateNew} {
     // clang-format off
     static const FunctionInfo functions[] = {
         {0, &BSD::RegisterClient, "RegisterClient"},
diff --git a/src/core/hle/service/sockets/sfdnsres.cpp b/src/core/hle/service/sockets/sfdnsres.cpp
index fb6142c49..a193fb578 100644
--- a/src/core/hle/service/sockets/sfdnsres.cpp
+++ b/src/core/hle/service/sockets/sfdnsres.cpp
@@ -2,8 +2,28 @@
 // Licensed under GPLv2 or any later version
 // Refer to the license.txt file included.
 
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "common/string_util.h"
+#include "common/swap.h"
+#include "core/core.h"
 #include "core/hle/ipc_helpers.h"
 #include "core/hle/service/sockets/sfdnsres.h"
+#include "core/memory.h"
+
+#ifdef _WIN32
+#include <ws2tcpip.h>
+#elif YUZU_UNIX
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <sys/socket.h>
+#ifndef EAI_NODATA
+#define EAI_NODATA EAI_NONAME
+#endif
+#endif
 
 namespace Service::Sockets {
 
@@ -21,7 +41,7 @@ SFDNSRES::SFDNSRES(Core::System& system_) : ServiceFramework{system_, "sfdnsres"
         {9, nullptr, "CancelRequest"},
         {10, nullptr, "GetHostByNameRequestWithOptions"},
         {11, nullptr, "GetHostByAddrRequestWithOptions"},
-        {12, nullptr, "GetAddrInfoRequestWithOptions"},
+        {12, &SFDNSRES::GetAddrInfoRequestWithOptions, "GetAddrInfoRequestWithOptions"},
         {13, nullptr, "GetNameInfoRequestWithOptions"},
         {14, nullptr, "ResolverSetOptionRequest"},
         {15, nullptr, "ResolverGetOptionRequest"},
@@ -31,7 +51,142 @@ SFDNSRES::SFDNSRES(Core::System& system_) : ServiceFramework{system_, "sfdnsres"
 
 SFDNSRES::~SFDNSRES() = default;
 
-void SFDNSRES::GetAddrInfoRequest(Kernel::HLERequestContext& ctx) {
+enum class NetDbError : s32 {
+    Internal = -1,
+    Success = 0,
+    HostNotFound = 1,
+    TryAgain = 2,
+    NoRecovery = 3,
+    NoData = 4,
+};
+
+static NetDbError AddrInfoErrorToNetDbError(s32 result) {
+    // Best effort guess to map errors
+    switch (result) {
+    case 0:
+        return NetDbError::Success;
+    case EAI_AGAIN:
+        return NetDbError::TryAgain;
+    case EAI_NODATA:
+        return NetDbError::NoData;
+    default:
+        return NetDbError::HostNotFound;
+    }
+}
+
+static std::vector<u8> SerializeAddrInfo(const addrinfo* addrinfo, s32 result_code,
+                                         std::string_view host) {
+    // Adapted from
+    // https://github.com/switchbrew/libnx/blob/c5a9a909a91657a9818a3b7e18c9b91ff0cbb6e3/nx/source/runtime/resolver.c#L190
+    std::vector<u8> data;
+
+    auto* current = addrinfo;
+    while (current != nullptr) {
+        struct SerializedResponseHeader {
+            u32 magic;
+            s32 flags;
+            s32 family;
+            s32 socket_type;
+            s32 protocol;
+            u32 address_length;
+        };
+        static_assert(sizeof(SerializedResponseHeader) == 0x18,
+                      "Response header size must be 0x18 bytes");
+
+        constexpr auto header_size = sizeof(SerializedResponseHeader);
+        const auto addr_size =
+            current->ai_addr && current->ai_addrlen > 0 ? current->ai_addrlen : 4;
+        const auto canonname_size = current->ai_canonname ? strlen(current->ai_canonname) + 1 : 1;
+
+        const auto last_size = data.size();
+        data.resize(last_size + header_size + addr_size + canonname_size);
+
+        // Header in network byte order
+        SerializedResponseHeader header{};
+
+        constexpr auto HEADER_MAGIC = 0xBEEFCAFE;
+        header.magic = htonl(HEADER_MAGIC);
+        header.family = htonl(current->ai_family);
+        header.flags = htonl(current->ai_flags);
+        header.socket_type = htonl(current->ai_socktype);
+        header.protocol = htonl(current->ai_protocol);
+        header.address_length = current->ai_addr ? htonl((u32)current->ai_addrlen) : 0;
+
+        auto* header_ptr = data.data() + last_size;
+        std::memcpy(header_ptr, &header, header_size);
+
+        if (header.address_length == 0) {
+            std::memset(header_ptr + header_size, 0, 4);
+        } else {
+            switch (current->ai_family) {
+            case AF_INET: {
+                struct SockAddrIn {
+                    s16 sin_family;
+                    u16 sin_port;
+                    u32 sin_addr;
+                    u8 sin_zero[8];
+                };
+
+                SockAddrIn serialized_addr{};
+                const auto addr = *reinterpret_cast<sockaddr_in*>(current->ai_addr);
+                serialized_addr.sin_port = htons(addr.sin_port);
+                serialized_addr.sin_family = htons(addr.sin_family);
+                serialized_addr.sin_addr = htonl(addr.sin_addr.s_addr);
+                std::memcpy(header_ptr + header_size, &serialized_addr, sizeof(SockAddrIn));
+
+                char addr_string_buf[64]{};
+                inet_ntop(AF_INET, &addr.sin_addr, addr_string_buf, std::size(addr_string_buf));
+                LOG_INFO(Service, "Resolved host '{}' to IPv4 address {}", host, addr_string_buf);
+                break;
+            }
+            case AF_INET6: {
+                struct SockAddrIn6 {
+                    s16 sin6_family;
+                    u16 sin6_port;
+                    u32 sin6_flowinfo;
+                    u8 sin6_addr[16];
+                    u32 sin6_scope_id;
+                };
+
+                SockAddrIn6 serialized_addr{};
+                const auto addr = *reinterpret_cast<sockaddr_in6*>(current->ai_addr);
+                serialized_addr.sin6_family = htons(addr.sin6_family);
+                serialized_addr.sin6_port = htons(addr.sin6_port);
+                serialized_addr.sin6_flowinfo = htonl(addr.sin6_flowinfo);
+                serialized_addr.sin6_scope_id = htonl(addr.sin6_scope_id);
+                std::memcpy(serialized_addr.sin6_addr, &addr.sin6_addr,
+                            sizeof(SockAddrIn6::sin6_addr));
+                std::memcpy(header_ptr + header_size, &serialized_addr, sizeof(SockAddrIn6));
+
+                char addr_string_buf[64]{};
+                inet_ntop(AF_INET6, &addr.sin6_addr, addr_string_buf, std::size(addr_string_buf));
+                LOG_INFO(Service, "Resolved host '{}' to IPv6 address {}", host, addr_string_buf);
+                break;
+            }
+            default:
+                std::memcpy(header_ptr + header_size, current->ai_addr, addr_size);
+                break;
+            }
+        }
+        if (current->ai_canonname) {
+            std::memcpy(header_ptr + addr_size, current->ai_canonname, canonname_size);
+        } else {
+            *(header_ptr + header_size + addr_size) = 0;
+        }
+
+        current = current->ai_next;
+    }
+
+    // 4-byte sentinel value
+    data.push_back(0);
+    data.push_back(0);
+    data.push_back(0);
+    data.push_back(0);
+
+    return data;
+}
+
+static std::pair<u32, s32> GetAddrInfoRequestImpl(Kernel::HLERequestContext& ctx) {
     struct Parameters {
         u8 use_nsd_resolve;
         u32 unknown;
@@ -42,11 +197,51 @@ void SFDNSRES::GetAddrInfoRequest(Kernel::HLERequestContext& ctx) {
     const auto parameters = rp.PopRaw<Parameters>();
 
     LOG_WARNING(Service,
-                "(STUBBED) called. use_nsd_resolve={}, unknown=0x{:08X}, process_id=0x{:016X}",
+                "called with ignored parameters: use_nsd_resolve={}, unknown={}, process_id={}",
                 parameters.use_nsd_resolve, parameters.unknown, parameters.process_id);
 
-    IPC::ResponseBuilder rb{ctx, 2};
+    const auto host_buffer = ctx.ReadBuffer(0);
+    const std::string host = Common::StringFromBuffer(host_buffer);
+
+    const auto service_buffer = ctx.ReadBuffer(1);
+    const std::string service = Common::StringFromBuffer(service_buffer);
+
+    addrinfo* addrinfo;
+    // Pass null for hints. Serialized hints are also passed in a buffer, but are ignored for now
+    s32 result_code = getaddrinfo(host.c_str(), service.c_str(), nullptr, &addrinfo);
+
+    u32 data_size = 0;
+    if (result_code == 0 && addrinfo != nullptr) {
+        const std::vector<u8>& data = SerializeAddrInfo(addrinfo, result_code, host);
+        data_size = static_cast<u32>(data.size());
+        freeaddrinfo(addrinfo);
+
+        ctx.WriteBuffer(data, 0);
+    }
+
+    return std::make_pair(data_size, result_code);
+}
+
+void SFDNSRES::GetAddrInfoRequest(Kernel::HLERequestContext& ctx) {
+    auto [data_size, result_code] = GetAddrInfoRequestImpl(ctx);
+
+    IPC::ResponseBuilder rb{ctx, 4};
+    rb.Push(ResultSuccess);
+    rb.Push(static_cast<s32>(AddrInfoErrorToNetDbError(result_code))); // NetDBErrorCode
+    rb.Push(result_code);                                              // errno
+    rb.Push(data_size);                                                // serialized size
+}
+
+void SFDNSRES::GetAddrInfoRequestWithOptions(Kernel::HLERequestContext& ctx) {
+    // Additional options are ignored
+    auto [data_size, result_code] = GetAddrInfoRequestImpl(ctx);
+
+    IPC::ResponseBuilder rb{ctx, 5};
     rb.Push(ResultSuccess);
+    rb.Push(data_size);                                                // serialized size
+    rb.Push(result_code);                                              // errno
+    rb.Push(static_cast<s32>(AddrInfoErrorToNetDbError(result_code))); // NetDBErrorCode
+    rb.Push(0);
 }
 
-} // namespace Service::Sockets
+} // namespace Service::Sockets
\ No newline at end of file
diff --git a/src/core/hle/service/sockets/sfdnsres.h b/src/core/hle/service/sockets/sfdnsres.h
index 5d3b4dc2d..f0c57377d 100644
--- a/src/core/hle/service/sockets/sfdnsres.h
+++ b/src/core/hle/service/sockets/sfdnsres.h
@@ -19,6 +19,7 @@ public:
 
 private:
     void GetAddrInfoRequest(Kernel::HLERequestContext& ctx);
+    void GetAddrInfoRequestWithOptions(Kernel::HLERequestContext& ctx);
 };
 
 } // namespace Service::Sockets
diff --git a/src/core/hle/service/sockets/sockets.h b/src/core/hle/service/sockets/sockets.h
index 02dbbae40..d69c86431 100644
--- a/src/core/hle/service/sockets/sockets.h
+++ b/src/core/hle/service/sockets/sockets.h
@@ -46,6 +46,7 @@ enum class Protocol : u32 {
 
 enum class OptName : u32 {
     REUSEADDR = 0x4,
+    KEEPALIVE = 0x8,
     BROADCAST = 0x20,
     LINGER = 0x80,
     SNDBUF = 0x1001,
diff --git a/src/core/hle/service/vi/display/vi_display.cpp b/src/core/hle/service/vi/display/vi_display.cpp
index b7705c02a..558022511 100644
--- a/src/core/hle/service/vi/display/vi_display.cpp
+++ b/src/core/hle/service/vi/display/vi_display.cpp
@@ -13,14 +13,34 @@
 #include "core/hle/kernel/k_readable_event.h"
 #include "core/hle/kernel/k_writable_event.h"
 #include "core/hle/service/kernel_helpers.h"
+#include "core/hle/service/nvflinger/buffer_item_consumer.h"
+#include "core/hle/service/nvflinger/buffer_queue_consumer.h"
+#include "core/hle/service/nvflinger/buffer_queue_core.h"
+#include "core/hle/service/nvflinger/buffer_queue_producer.h"
+#include "core/hle/service/nvflinger/hos_binder_driver_server.h"
 #include "core/hle/service/vi/display/vi_display.h"
 #include "core/hle/service/vi/layer/vi_layer.h"
 
 namespace Service::VI {
 
-Display::Display(u64 id, std::string name_, KernelHelpers::ServiceContext& service_context_,
-                 Core::System& system_)
-    : display_id{id}, name{std::move(name_)}, service_context{service_context_} {
+struct BufferQueue {
+    std::shared_ptr<android::BufferQueueCore> core;
+    std::unique_ptr<android::BufferQueueProducer> producer;
+    std::unique_ptr<android::BufferQueueConsumer> consumer;
+};
+
+static BufferQueue CreateBufferQueue(KernelHelpers::ServiceContext& service_context) {
+    auto buffer_queue_core = std::make_shared<android::BufferQueueCore>();
+    return {buffer_queue_core,
+            std::make_unique<android::BufferQueueProducer>(service_context, buffer_queue_core),
+            std::make_unique<android::BufferQueueConsumer>(buffer_queue_core)};
+}
+
+Display::Display(u64 id, std::string name_,
+                 NVFlinger::HosBinderDriverServer& hos_binder_driver_server_,
+                 KernelHelpers::ServiceContext& service_context_, Core::System& system_)
+    : display_id{id}, name{std::move(name_)}, hos_binder_driver_server{hos_binder_driver_server_},
+      service_context{service_context_} {
     vsync_event = service_context.CreateEvent(fmt::format("Display VSync Event {}", id));
 }
 
@@ -44,21 +64,29 @@ void Display::SignalVSyncEvent() {
     vsync_event->GetWritableEvent().Signal();
 }
 
-void Display::CreateLayer(u64 layer_id, NVFlinger::BufferQueue& buffer_queue) {
-    // TODO(Subv): Support more than 1 layer.
+void Display::CreateLayer(u64 layer_id, u32 binder_id) {
     ASSERT_MSG(layers.empty(), "Only one layer is supported per display at the moment");
 
-    layers.emplace_back(std::make_shared<Layer>(layer_id, buffer_queue));
+    auto [core, producer, consumer] = CreateBufferQueue(service_context);
+
+    auto buffer_item_consumer = std::make_shared<android::BufferItemConsumer>(std::move(consumer));
+    buffer_item_consumer->Connect(false);
+
+    layers.emplace_back(std::make_unique<Layer>(layer_id, binder_id, *core, *producer,
+                                                std::move(buffer_item_consumer)));
+
+    hos_binder_driver_server.RegisterProducer(std::move(producer));
 }
 
 void Display::CloseLayer(u64 layer_id) {
-    std::erase_if(layers, [layer_id](const auto& layer) { return layer->GetID() == layer_id; });
+    std::erase_if(layers,
+                  [layer_id](const auto& layer) { return layer->GetLayerId() == layer_id; });
 }
 
 Layer* Display::FindLayer(u64 layer_id) {
     const auto itr =
-        std::find_if(layers.begin(), layers.end(), [layer_id](const std::shared_ptr<Layer>& layer) {
-            return layer->GetID() == layer_id;
+        std::find_if(layers.begin(), layers.end(), [layer_id](const std::unique_ptr<Layer>& layer) {
+            return layer->GetLayerId() == layer_id;
         });
 
     if (itr == layers.end()) {
@@ -70,8 +98,8 @@ Layer* Display::FindLayer(u64 layer_id) {
 
 const Layer* Display::FindLayer(u64 layer_id) const {
     const auto itr =
-        std::find_if(layers.begin(), layers.end(), [layer_id](const std::shared_ptr<Layer>& layer) {
-            return layer->GetID() == layer_id;
+        std::find_if(layers.begin(), layers.end(), [layer_id](const std::unique_ptr<Layer>& layer) {
+            return layer->GetLayerId() == layer_id;
         });
 
     if (itr == layers.end()) {
diff --git a/src/core/hle/service/vi/display/vi_display.h b/src/core/hle/service/vi/display/vi_display.h
index 329f4ba86..e93d084ee 100644
--- a/src/core/hle/service/vi/display/vi_display.h
+++ b/src/core/hle/service/vi/display/vi_display.h
@@ -15,12 +15,17 @@ namespace Kernel {
 class KEvent;
 }
 
-namespace Service::NVFlinger {
-class BufferQueue;
+namespace Service::android {
+class BufferQueueProducer;
 }
+
 namespace Service::KernelHelpers {
 class ServiceContext;
-} // namespace Service::KernelHelpers
+}
+
+namespace Service::NVFlinger {
+class HosBinderDriverServer;
+}
 
 namespace Service::VI {
 
@@ -35,12 +40,13 @@ public:
     /// Constructs a display with a given unique ID and name.
     ///
     /// @param id The unique ID for this display.
+    /// @param hos_binder_driver_server_ NVFlinger HOSBinderDriver server instance.
     /// @param service_context_ The ServiceContext for the owning service.
     /// @param name_ The name for this display.
     /// @param system_ The global system instance.
     ///
-    Display(u64 id, std::string name_, KernelHelpers::ServiceContext& service_context_,
-            Core::System& system_);
+    Display(u64 id, std::string name_, NVFlinger::HosBinderDriverServer& hos_binder_driver_server_,
+            KernelHelpers::ServiceContext& service_context_, Core::System& system_);
     ~Display();
 
     /// Gets the unique ID assigned to this display.
@@ -64,6 +70,10 @@ public:
     /// Gets a layer for this display based off an index.
     const Layer& GetLayer(std::size_t index) const;
 
+    std::size_t GetNumLayers() const {
+        return layers.size();
+    }
+
     /// Gets the readable vsync event.
     Kernel::KReadableEvent& GetVSyncEvent();
 
@@ -72,10 +82,10 @@ public:
 
     /// Creates and adds a layer to this display with the given ID.
     ///
-    /// @param layer_id     The ID to assign to the created layer.
-    /// @param buffer_queue The buffer queue for the layer instance to use.
+    /// @param layer_id The ID to assign to the created layer.
+    /// @param binder_id The ID assigned to the buffer queue.
     ///
-    void CreateLayer(u64 layer_id, NVFlinger::BufferQueue& buffer_queue);
+    void CreateLayer(u64 layer_id, u32 binder_id);
 
     /// Closes and removes a layer from this display with the given ID.
     ///
@@ -104,9 +114,10 @@ public:
 private:
     u64 display_id;
     std::string name;
+    NVFlinger::HosBinderDriverServer& hos_binder_driver_server;
     KernelHelpers::ServiceContext& service_context;
 
-    std::vector<std::shared_ptr<Layer>> layers;
+    std::vector<std::unique_ptr<Layer>> layers;
     Kernel::KEvent* vsync_event{};
 };
 
diff --git a/src/core/hle/service/vi/layer/vi_layer.cpp b/src/core/hle/service/vi/layer/vi_layer.cpp
index 9bc382587..93858e91f 100644
--- a/src/core/hle/service/vi/layer/vi_layer.cpp
+++ b/src/core/hle/service/vi/layer/vi_layer.cpp
@@ -6,7 +6,11 @@
 
 namespace Service::VI {
 
-Layer::Layer(u64 id, NVFlinger::BufferQueue& queue) : layer_id{id}, buffer_queue{queue} {}
+Layer::Layer(u64 layer_id_, u32 binder_id_, android::BufferQueueCore& core_,
+             android::BufferQueueProducer& binder_,
+             std::shared_ptr<android::BufferItemConsumer>&& consumer_)
+    : layer_id{layer_id_}, binder_id{binder_id_}, core{core_}, binder{binder_}, consumer{std::move(
+                                                                                    consumer_)} {}
 
 Layer::~Layer() = default;
 
diff --git a/src/core/hle/service/vi/layer/vi_layer.h b/src/core/hle/service/vi/layer/vi_layer.h
index ebdd85505..c28b14450 100644
--- a/src/core/hle/service/vi/layer/vi_layer.h
+++ b/src/core/hle/service/vi/layer/vi_layer.h
@@ -4,11 +4,15 @@
 
 #pragma once
 
+#include <memory>
+
 #include "common/common_types.h"
 
-namespace Service::NVFlinger {
-class BufferQueue;
-}
+namespace Service::android {
+class BufferItemConsumer;
+class BufferQueueCore;
+class BufferQueueProducer;
+} // namespace Service::android
 
 namespace Service::VI {
 
@@ -17,10 +21,13 @@ class Layer {
 public:
     /// Constructs a layer with a given ID and buffer queue.
     ///
-    /// @param id    The ID to assign to this layer.
-    /// @param queue The buffer queue for this layer to use.
+    /// @param layer_id_ The ID to assign to this layer.
+    /// @param binder_id_ The binder ID to assign to this layer.
+    /// @param binder_ The buffer producer queue for this layer to use.
     ///
-    Layer(u64 id, NVFlinger::BufferQueue& queue);
+    Layer(u64 layer_id_, u32 binder_id_, android::BufferQueueCore& core_,
+          android::BufferQueueProducer& binder_,
+          std::shared_ptr<android::BufferItemConsumer>&& consumer_);
     ~Layer();
 
     Layer(const Layer&) = delete;
@@ -30,23 +37,47 @@ public:
     Layer& operator=(Layer&&) = delete;
 
     /// Gets the ID for this layer.
-    u64 GetID() const {
+    u64 GetLayerId() const {
         return layer_id;
     }
 
+    /// Gets the binder ID for this layer.
+    u32 GetBinderId() const {
+        return binder_id;
+    }
+
     /// Gets a reference to the buffer queue this layer is using.
-    NVFlinger::BufferQueue& GetBufferQueue() {
-        return buffer_queue;
+    android::BufferQueueProducer& GetBufferQueue() {
+        return binder;
     }
 
     /// Gets a const reference to the buffer queue this layer is using.
-    const NVFlinger::BufferQueue& GetBufferQueue() const {
-        return buffer_queue;
+    const android::BufferQueueProducer& GetBufferQueue() const {
+        return binder;
+    }
+
+    android::BufferItemConsumer& GetConsumer() {
+        return *consumer;
+    }
+
+    const android::BufferItemConsumer& GetConsumer() const {
+        return *consumer;
+    }
+
+    android::BufferQueueCore& Core() {
+        return core;
+    }
+
+    const android::BufferQueueCore& Core() const {
+        return core;
     }
 
 private:
-    u64 layer_id;
-    NVFlinger::BufferQueue& buffer_queue;
+    const u64 layer_id;
+    const u32 binder_id;
+    android::BufferQueueCore& core;
+    android::BufferQueueProducer& binder;
+    std::shared_ptr<android::BufferItemConsumer> consumer;
 };
 
 } // namespace Service::VI
diff --git a/src/core/hle/service/vi/vi.cpp b/src/core/hle/service/vi/vi.cpp
index 75ee3e5e4..a3436c8ea 100644
--- a/src/core/hle/service/vi/vi.cpp
+++ b/src/core/hle/service/vi/vi.cpp
@@ -22,8 +22,11 @@
 #include "core/hle/kernel/k_readable_event.h"
 #include "core/hle/kernel/k_thread.h"
 #include "core/hle/service/nvdrv/nvdata.h"
-#include "core/hle/service/nvflinger/buffer_queue.h"
+#include "core/hle/service/nvflinger/binder.h"
+#include "core/hle/service/nvflinger/buffer_queue_producer.h"
+#include "core/hle/service/nvflinger/hos_binder_driver_server.h"
 #include "core/hle/service/nvflinger/nvflinger.h"
+#include "core/hle/service/nvflinger/parcel.h"
 #include "core/hle/service/service.h"
 #include "core/hle/service/vi/vi.h"
 #include "core/hle/service/vi/vi_m.h"
@@ -57,447 +60,25 @@ struct DisplayInfo {
 };
 static_assert(sizeof(DisplayInfo) == 0x60, "DisplayInfo has wrong size");
 
-class Parcel {
+class NativeWindow final {
 public:
-    // This default size was chosen arbitrarily.
-    static constexpr std::size_t DefaultBufferSize = 0x40;
-    Parcel() : buffer(DefaultBufferSize) {}
-    explicit Parcel(std::vector<u8> data) : buffer(std::move(data)) {}
-    virtual ~Parcel() = default;
-
-    template <typename T>
-    T Read() {
-        static_assert(std::is_trivially_copyable_v<T>, "T must be trivially copyable.");
-        ASSERT(read_index + sizeof(T) <= buffer.size());
-
-        T val;
-        std::memcpy(&val, buffer.data() + read_index, sizeof(T));
-        read_index += sizeof(T);
-        read_index = Common::AlignUp(read_index, 4);
-        return val;
-    }
-
-    template <typename T>
-    T ReadUnaligned() {
-        static_assert(std::is_trivially_copyable_v<T>, "T must be trivially copyable.");
-        ASSERT(read_index + sizeof(T) <= buffer.size());
-
-        T val;
-        std::memcpy(&val, buffer.data() + read_index, sizeof(T));
-        read_index += sizeof(T);
-        return val;
-    }
-
-    std::vector<u8> ReadBlock(std::size_t length) {
-        ASSERT(read_index + length <= buffer.size());
-        const u8* const begin = buffer.data() + read_index;
-        const u8* const end = begin + length;
-        std::vector<u8> data(begin, end);
-        read_index += length;
-        read_index = Common::AlignUp(read_index, 4);
-        return data;
-    }
-
-    std::u16string ReadInterfaceToken() {
-        [[maybe_unused]] const u32 unknown = Read<u32_le>();
-        const u32 length = Read<u32_le>();
-
-        std::u16string token{};
-
-        for (u32 ch = 0; ch < length + 1; ++ch) {
-            token.push_back(ReadUnaligned<u16_le>());
-        }
-
-        read_index = Common::AlignUp(read_index, 4);
-
-        return token;
-    }
-
-    template <typename T>
-    void Write(const T& val) {
-        static_assert(std::is_trivially_copyable_v<T>, "T must be trivially copyable.");
-
-        if (buffer.size() < write_index + sizeof(T)) {
-            buffer.resize(buffer.size() + sizeof(T) + DefaultBufferSize);
-        }
-
-        std::memcpy(buffer.data() + write_index, &val, sizeof(T));
-        write_index += sizeof(T);
-        write_index = Common::AlignUp(write_index, 4);
-    }
-
-    template <typename T>
-    void WriteObject(const T& val) {
-        static_assert(std::is_trivially_copyable_v<T>, "T must be trivially copyable.");
-
-        const u32_le size = static_cast<u32>(sizeof(val));
-        Write(size);
-        // TODO(Subv): Support file descriptors.
-        Write<u32_le>(0); // Fd count.
-        Write(val);
-    }
-
-    void Deserialize() {
-        ASSERT(buffer.size() > sizeof(Header));
-
-        Header header{};
-        std::memcpy(&header, buffer.data(), sizeof(Header));
-
-        read_index = header.data_offset;
-        DeserializeData();
-    }
-
-    std::vector<u8> Serialize() {
-        ASSERT(read_index == 0);
-        write_index = sizeof(Header);
-
-        SerializeData();
-
-        Header header{};
-        header.data_size = static_cast<u32_le>(write_index - sizeof(Header));
-        header.data_offset = sizeof(Header);
-        header.objects_size = 4;
-        header.objects_offset = static_cast<u32>(sizeof(Header) + header.data_size);
-        std::memcpy(buffer.data(), &header, sizeof(Header));
-
-        return buffer;
-    }
-
-protected:
-    virtual void SerializeData() {}
-
-    virtual void DeserializeData() {}
-
-private:
-    struct Header {
-        u32_le data_size;
-        u32_le data_offset;
-        u32_le objects_size;
-        u32_le objects_offset;
-    };
-    static_assert(sizeof(Header) == 16, "ParcelHeader has wrong size");
-
-    std::vector<u8> buffer;
-    std::size_t read_index = 0;
-    std::size_t write_index = 0;
-};
-
-class NativeWindow : public Parcel {
-public:
-    explicit NativeWindow(u32 id) {
-        data.id = id;
-    }
-    ~NativeWindow() override = default;
-
-protected:
-    void SerializeData() override {
-        Write(data);
-    }
-
-private:
-    struct Data {
-        u32_le magic = 2;
-        u32_le process_id = 1;
-        u32_le id;
-        INSERT_PADDING_WORDS(3);
-        std::array<u8, 8> dispdrv = {'d', 'i', 's', 'p', 'd', 'r', 'v', '\0'};
-        INSERT_PADDING_WORDS(2);
-    };
-    static_assert(sizeof(Data) == 0x28, "ParcelData has wrong size");
-
-    Data data{};
-};
-
-class IGBPConnectRequestParcel : public Parcel {
-public:
-    explicit IGBPConnectRequestParcel(std::vector<u8> buffer_) : Parcel(std::move(buffer_)) {
-        Deserialize();
-    }
-
-    void DeserializeData() override {
-        [[maybe_unused]] const std::u16string token = ReadInterfaceToken();
-        data = Read<Data>();
-    }
-
-    struct Data {
-        u32_le unk;
-        u32_le api;
-        u32_le producer_controlled_by_app;
-    };
-
-    Data data;
-};
-
-class IGBPConnectResponseParcel : public Parcel {
-public:
-    explicit IGBPConnectResponseParcel(u32 width, u32 height) {
-        data.width = width;
-        data.height = height;
-    }
-    ~IGBPConnectResponseParcel() override = default;
-
-protected:
-    void SerializeData() override {
-        Write(data);
-    }
-
-private:
-    struct Data {
-        u32_le width;
-        u32_le height;
-        u32_le transform_hint;
-        u32_le num_pending_buffers;
-        u32_le status;
-    };
-    static_assert(sizeof(Data) == 20, "ParcelData has wrong size");
-
-    Data data{};
-};
-
-/// Represents a parcel containing one int '0' as its data
-/// Used by DetachBuffer and Disconnect
-class IGBPEmptyResponseParcel : public Parcel {
-protected:
-    void SerializeData() override {
-        Write(data);
-    }
-
-private:
-    struct Data {
-        u32_le unk_0{};
-    };
-
-    Data data{};
-};
-
-class IGBPSetPreallocatedBufferRequestParcel : public Parcel {
-public:
-    explicit IGBPSetPreallocatedBufferRequestParcel(std::vector<u8> buffer_)
-        : Parcel(std::move(buffer_)) {
-        Deserialize();
-    }
-
-    void DeserializeData() override {
-        [[maybe_unused]] const std::u16string token = ReadInterfaceToken();
-        data = Read<Data>();
-        if (data.contains_object != 0) {
-            buffer_container = Read<BufferContainer>();
-        }
-    }
-
-    struct Data {
-        u32_le slot;
-        u32_le contains_object;
-    };
-
-    struct BufferContainer {
-        u32_le graphic_buffer_length;
-        INSERT_PADDING_WORDS(1);
-        NVFlinger::IGBPBuffer buffer{};
-    };
-
-    Data data{};
-    BufferContainer buffer_container{};
-};
-
-class IGBPSetPreallocatedBufferResponseParcel : public Parcel {
-protected:
-    void SerializeData() override {
-        // TODO(Subv): Find out what this means
-        Write<u32>(0);
-    }
-};
-
-class IGBPCancelBufferRequestParcel : public Parcel {
-public:
-    explicit IGBPCancelBufferRequestParcel(std::vector<u8> buffer_) : Parcel(std::move(buffer_)) {
-        Deserialize();
-    }
-
-    void DeserializeData() override {
-        [[maybe_unused]] const std::u16string token = ReadInterfaceToken();
-        data = Read<Data>();
-    }
-
-    struct Data {
-        u32_le slot;
-        Service::Nvidia::MultiFence multi_fence;
-    };
-
-    Data data;
-};
-
-class IGBPCancelBufferResponseParcel : public Parcel {
-protected:
-    void SerializeData() override {
-        Write<u32>(0); // Success
-    }
-};
-
-class IGBPDequeueBufferRequestParcel : public Parcel {
-public:
-    explicit IGBPDequeueBufferRequestParcel(std::vector<u8> buffer_) : Parcel(std::move(buffer_)) {
-        Deserialize();
-    }
-
-    void DeserializeData() override {
-        [[maybe_unused]] const std::u16string token = ReadInterfaceToken();
-        data = Read<Data>();
-    }
-
-    struct Data {
-        u32_le pixel_format;
-        u32_le width;
-        u32_le height;
-        u32_le get_frame_timestamps;
-        u32_le usage;
-    };
-
-    Data data;
-};
-
-class IGBPDequeueBufferResponseParcel : public Parcel {
-public:
-    explicit IGBPDequeueBufferResponseParcel(u32 slot_, Nvidia::MultiFence& multi_fence_)
-        : slot(slot_), multi_fence(multi_fence_) {}
-
-protected:
-    void SerializeData() override {
-        Write(slot);
-        Write<u32_le>(1);
-        WriteObject(multi_fence);
-        Write<u32_le>(0);
-    }
-
-    u32_le slot;
-    Service::Nvidia::MultiFence multi_fence;
-};
-
-class IGBPRequestBufferRequestParcel : public Parcel {
-public:
-    explicit IGBPRequestBufferRequestParcel(std::vector<u8> buffer_) : Parcel(std::move(buffer_)) {
-        Deserialize();
-    }
-
-    void DeserializeData() override {
-        [[maybe_unused]] const std::u16string token = ReadInterfaceToken();
-        slot = Read<u32_le>();
-    }
-
-    u32_le slot;
-};
-
-class IGBPRequestBufferResponseParcel : public Parcel {
-public:
-    explicit IGBPRequestBufferResponseParcel(NVFlinger::IGBPBuffer buffer_) : buffer(buffer_) {}
-    ~IGBPRequestBufferResponseParcel() override = default;
-
-protected:
-    void SerializeData() override {
-        // TODO(Subv): Figure out what this value means, writing non-zero here will make libnx
-        // try to read an IGBPBuffer object from the parcel.
-        Write<u32_le>(1);
-        WriteObject(buffer);
-        Write<u32_le>(0);
-    }
-
-    NVFlinger::IGBPBuffer buffer;
-};
-
-class IGBPQueueBufferRequestParcel : public Parcel {
-public:
-    explicit IGBPQueueBufferRequestParcel(std::vector<u8> buffer_) : Parcel(std::move(buffer_)) {
-        Deserialize();
-    }
-
-    void DeserializeData() override {
-        [[maybe_unused]] const std::u16string token = ReadInterfaceToken();
-        data = Read<Data>();
-    }
-
-    struct Data {
-        u32_le slot;
-        INSERT_PADDING_WORDS(3);
-        u32_le timestamp;
-        s32_le is_auto_timestamp;
-        s32_le crop_top;
-        s32_le crop_left;
-        s32_le crop_right;
-        s32_le crop_bottom;
-        s32_le scaling_mode;
-        NVFlinger::BufferQueue::BufferTransformFlags transform;
-        u32_le sticky_transform;
-        INSERT_PADDING_WORDS(1);
-        u32_le swap_interval;
-        Service::Nvidia::MultiFence multi_fence;
-
-        Common::Rectangle<int> GetCropRect() const {
-            return {crop_left, crop_top, crop_right, crop_bottom};
-        }
-    };
-    static_assert(sizeof(Data) == 96, "ParcelData has wrong size");
-
-    Data data;
-};
-
-class IGBPQueueBufferResponseParcel : public Parcel {
-public:
-    explicit IGBPQueueBufferResponseParcel(u32 width, u32 height) {
-        data.width = width;
-        data.height = height;
-    }
-    ~IGBPQueueBufferResponseParcel() override = default;
-
-protected:
-    void SerializeData() override {
-        Write(data);
-    }
-
-private:
-    struct Data {
-        u32_le width;
-        u32_le height;
-        u32_le transform_hint;
-        u32_le num_pending_buffers;
-        u32_le status;
-    };
-    static_assert(sizeof(Data) == 20, "ParcelData has wrong size");
-
-    Data data{};
-};
-
-class IGBPQueryRequestParcel : public Parcel {
-public:
-    explicit IGBPQueryRequestParcel(std::vector<u8> buffer_) : Parcel(std::move(buffer_)) {
-        Deserialize();
-    }
-
-    void DeserializeData() override {
-        [[maybe_unused]] const std::u16string token = ReadInterfaceToken();
-        type = Read<u32_le>();
-    }
-
-    u32 type;
-};
-
-class IGBPQueryResponseParcel : public Parcel {
-public:
-    explicit IGBPQueryResponseParcel(u32 value_) : value{value_} {}
-    ~IGBPQueryResponseParcel() override = default;
-
-protected:
-    void SerializeData() override {
-        Write(value);
-    }
+    constexpr explicit NativeWindow(u32 id_) : id{id_} {}
 
 private:
-    u32_le value;
+    const u32 magic = 2;
+    const u32 process_id = 1;
+    const u32 id;
+    INSERT_PADDING_WORDS(3);
+    std::array<u8, 8> dispdrv = {'d', 'i', 's', 'p', 'd', 'r', 'v', '\0'};
+    INSERT_PADDING_WORDS(2);
 };
+static_assert(sizeof(NativeWindow) == 0x28, "NativeWindow has wrong size");
 
 class IHOSBinderDriver final : public ServiceFramework<IHOSBinderDriver> {
 public:
-    explicit IHOSBinderDriver(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_)
-        : ServiceFramework{system_, "IHOSBinderDriver"}, nv_flinger(nv_flinger_) {
+    explicit IHOSBinderDriver(Core::System& system_, NVFlinger::HosBinderDriverServer& server_)
+        : ServiceFramework{system_, "IHOSBinderDriver", ServiceThreadType::CreateNew},
+          server(server_) {
         static const FunctionInfo functions[] = {
             {0, &IHOSBinderDriver::TransactParcel, "TransactParcel"},
             {1, &IHOSBinderDriver::AdjustRefcount, "AdjustRefcount"},
@@ -508,147 +89,16 @@ public:
     }
 
 private:
-    enum class TransactionId {
-        RequestBuffer = 1,
-        SetBufferCount = 2,
-        DequeueBuffer = 3,
-        DetachBuffer = 4,
-        DetachNextBuffer = 5,
-        AttachBuffer = 6,
-        QueueBuffer = 7,
-        CancelBuffer = 8,
-        Query = 9,
-        Connect = 10,
-        Disconnect = 11,
-
-        AllocateBuffers = 13,
-        SetPreallocatedBuffer = 14,
-
-        GetBufferHistory = 17
-    };
-
     void TransactParcel(Kernel::HLERequestContext& ctx) {
         IPC::RequestParser rp{ctx};
         const u32 id = rp.Pop<u32>();
-        const auto transaction = static_cast<TransactionId>(rp.Pop<u32>());
+        const auto transaction = static_cast<android::TransactionId>(rp.Pop<u32>());
         const u32 flags = rp.Pop<u32>();
 
         LOG_DEBUG(Service_VI, "called. id=0x{:08X} transaction={:X}, flags=0x{:08X}", id,
                   transaction, flags);
 
-        auto& buffer_queue = *nv_flinger.FindBufferQueue(id);
-
-        switch (transaction) {
-        case TransactionId::Connect: {
-            IGBPConnectRequestParcel request{ctx.ReadBuffer()};
-            IGBPConnectResponseParcel response{static_cast<u32>(DisplayResolution::UndockedWidth),
-                                               static_cast<u32>(DisplayResolution::UndockedHeight)};
-
-            buffer_queue.Connect();
-
-            ctx.WriteBuffer(response.Serialize());
-            break;
-        }
-        case TransactionId::SetPreallocatedBuffer: {
-            IGBPSetPreallocatedBufferRequestParcel request{ctx.ReadBuffer()};
-
-            buffer_queue.SetPreallocatedBuffer(request.data.slot, request.buffer_container.buffer);
-
-            IGBPSetPreallocatedBufferResponseParcel response{};
-            ctx.WriteBuffer(response.Serialize());
-            break;
-        }
-        case TransactionId::DequeueBuffer: {
-            IGBPDequeueBufferRequestParcel request{ctx.ReadBuffer()};
-            const u32 width{request.data.width};
-            const u32 height{request.data.height};
-
-            do {
-                if (auto result = buffer_queue.DequeueBuffer(width, height); result) {
-                    // Buffer is available
-                    IGBPDequeueBufferResponseParcel response{result->first, *result->second};
-                    ctx.WriteBuffer(response.Serialize());
-                    break;
-                }
-            } while (buffer_queue.IsConnected());
-
-            break;
-        }
-        case TransactionId::RequestBuffer: {
-            IGBPRequestBufferRequestParcel request{ctx.ReadBuffer()};
-
-            auto& buffer = buffer_queue.RequestBuffer(request.slot);
-            IGBPRequestBufferResponseParcel response{buffer};
-            ctx.WriteBuffer(response.Serialize());
-
-            break;
-        }
-        case TransactionId::QueueBuffer: {
-            IGBPQueueBufferRequestParcel request{ctx.ReadBuffer()};
-
-            buffer_queue.QueueBuffer(request.data.slot, request.data.transform,
-                                     request.data.GetCropRect(), request.data.swap_interval,
-                                     request.data.multi_fence);
-
-            IGBPQueueBufferResponseParcel response{1280, 720};
-            ctx.WriteBuffer(response.Serialize());
-            break;
-        }
-        case TransactionId::Query: {
-            IGBPQueryRequestParcel request{ctx.ReadBuffer()};
-
-            const u32 value =
-                buffer_queue.Query(static_cast<NVFlinger::BufferQueue::QueryType>(request.type));
-
-            IGBPQueryResponseParcel response{value};
-            ctx.WriteBuffer(response.Serialize());
-            break;
-        }
-        case TransactionId::CancelBuffer: {
-            IGBPCancelBufferRequestParcel request{ctx.ReadBuffer()};
-
-            buffer_queue.CancelBuffer(request.data.slot, request.data.multi_fence);
-
-            IGBPCancelBufferResponseParcel response{};
-            ctx.WriteBuffer(response.Serialize());
-            break;
-        }
-        case TransactionId::Disconnect: {
-            LOG_WARNING(Service_VI, "(STUBBED) called, transaction=Disconnect");
-            const auto buffer = ctx.ReadBuffer();
-
-            buffer_queue.Disconnect();
-
-            IGBPEmptyResponseParcel response{};
-            ctx.WriteBuffer(response.Serialize());
-            break;
-        }
-        case TransactionId::DetachBuffer: {
-            const auto buffer = ctx.ReadBuffer();
-
-            IGBPEmptyResponseParcel response{};
-            ctx.WriteBuffer(response.Serialize());
-            break;
-        }
-        case TransactionId::SetBufferCount: {
-            LOG_WARNING(Service_VI, "(STUBBED) called, transaction=SetBufferCount");
-            [[maybe_unused]] const auto buffer = ctx.ReadBuffer();
-
-            IGBPEmptyResponseParcel response{};
-            ctx.WriteBuffer(response.Serialize());
-            break;
-        }
-        case TransactionId::GetBufferHistory: {
-            LOG_WARNING(Service_VI, "(STUBBED) called, transaction=GetBufferHistory");
-            [[maybe_unused]] const auto buffer = ctx.ReadBuffer();
-
-            IGBPEmptyResponseParcel response{};
-            ctx.WriteBuffer(response.Serialize());
-            break;
-        }
-        default:
-            ASSERT_MSG(false, "Unimplemented");
-        }
+        server.TryGetProducer(id)->Transact(ctx, transaction, flags);
 
         IPC::ResponseBuilder rb{ctx, 2};
         rb.Push(ResultSuccess);
@@ -674,13 +124,13 @@ private:
 
         LOG_WARNING(Service_VI, "(STUBBED) called id={}, unknown={:08X}", id, unknown);
 
-        // TODO(Subv): Find out what this actually is.
         IPC::ResponseBuilder rb{ctx, 2, 1};
         rb.Push(ResultSuccess);
-        rb.PushCopyObjects(nv_flinger.FindBufferQueue(id)->GetBufferWaitEvent());
+        rb.PushCopyObjects(server.TryGetProducer(id)->GetNativeHandle());
     }
 
-    NVFlinger::NVFlinger& nv_flinger;
+private:
+    NVFlinger::HosBinderDriverServer& server;
 };
 
 class ISystemDisplayService final : public ServiceFramework<ISystemDisplayService> {
@@ -937,7 +387,40 @@ private:
 
 class IApplicationDisplayService final : public ServiceFramework<IApplicationDisplayService> {
 public:
-    explicit IApplicationDisplayService(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_);
+    IApplicationDisplayService(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_,
+                               NVFlinger::HosBinderDriverServer& hos_binder_driver_server_)
+        : ServiceFramework{system_, "IApplicationDisplayService"}, nv_flinger{nv_flinger_},
+          hos_binder_driver_server{hos_binder_driver_server_} {
+
+        static const FunctionInfo functions[] = {
+            {100, &IApplicationDisplayService::GetRelayService, "GetRelayService"},
+            {101, &IApplicationDisplayService::GetSystemDisplayService, "GetSystemDisplayService"},
+            {102, &IApplicationDisplayService::GetManagerDisplayService,
+             "GetManagerDisplayService"},
+            {103, &IApplicationDisplayService::GetIndirectDisplayTransactionService,
+             "GetIndirectDisplayTransactionService"},
+            {1000, &IApplicationDisplayService::ListDisplays, "ListDisplays"},
+            {1010, &IApplicationDisplayService::OpenDisplay, "OpenDisplay"},
+            {1011, &IApplicationDisplayService::OpenDefaultDisplay, "OpenDefaultDisplay"},
+            {1020, &IApplicationDisplayService::CloseDisplay, "CloseDisplay"},
+            {1101, &IApplicationDisplayService::SetDisplayEnabled, "SetDisplayEnabled"},
+            {1102, &IApplicationDisplayService::GetDisplayResolution, "GetDisplayResolution"},
+            {2020, &IApplicationDisplayService::OpenLayer, "OpenLayer"},
+            {2021, &IApplicationDisplayService::CloseLayer, "CloseLayer"},
+            {2030, &IApplicationDisplayService::CreateStrayLayer, "CreateStrayLayer"},
+            {2031, &IApplicationDisplayService::DestroyStrayLayer, "DestroyStrayLayer"},
+            {2101, &IApplicationDisplayService::SetLayerScalingMode, "SetLayerScalingMode"},
+            {2102, &IApplicationDisplayService::ConvertScalingMode, "ConvertScalingMode"},
+            {2450, &IApplicationDisplayService::GetIndirectLayerImageMap,
+             "GetIndirectLayerImageMap"},
+            {2451, nullptr, "GetIndirectLayerImageCropMap"},
+            {2460, &IApplicationDisplayService::GetIndirectLayerImageRequiredMemoryInfo,
+             "GetIndirectLayerImageRequiredMemoryInfo"},
+            {5202, &IApplicationDisplayService::GetDisplayVsyncEvent, "GetDisplayVsyncEvent"},
+            {5203, nullptr, "GetDisplayVsyncEventForDebug"},
+        };
+        RegisterHandlers(functions);
+    }
 
 private:
     enum class ConvertedScaleMode : u64 {
@@ -961,7 +444,7 @@ private:
 
         IPC::ResponseBuilder rb{ctx, 2, 0, 1};
         rb.Push(ResultSuccess);
-        rb.PushIpcInterface<IHOSBinderDriver>(system, nv_flinger);
+        rb.PushIpcInterface<IHOSBinderDriver>(system, hos_binder_driver_server);
     }
 
     void GetSystemDisplayService(Kernel::HLERequestContext& ctx) {
@@ -985,7 +468,7 @@ private:
 
         IPC::ResponseBuilder rb{ctx, 2, 0, 1};
         rb.Push(ResultSuccess);
-        rb.PushIpcInterface<IHOSBinderDriver>(system, nv_flinger);
+        rb.PushIpcInterface<IHOSBinderDriver>(system, hos_binder_driver_server);
     }
 
     void OpenDisplay(Kernel::HLERequestContext& ctx) {
@@ -1089,7 +572,7 @@ private:
     void ListDisplays(Kernel::HLERequestContext& ctx) {
         LOG_WARNING(Service_VI, "(STUBBED) called");
 
-        DisplayInfo display_info;
+        const DisplayInfo display_info;
         ctx.WriteBuffer(&display_info, sizeof(DisplayInfo));
         IPC::ResponseBuilder rb{ctx, 4};
         rb.Push(ResultSuccess);
@@ -1124,8 +607,8 @@ private:
             return;
         }
 
-        NativeWindow native_window{*buffer_queue_id};
-        const auto buffer_size = ctx.WriteBuffer(native_window.Serialize());
+        const auto parcel = android::Parcel{NativeWindow{*buffer_queue_id}};
+        const auto buffer_size = ctx.WriteBuffer(parcel.Serialize());
 
         IPC::ResponseBuilder rb{ctx, 4};
         rb.Push(ResultSuccess);
@@ -1170,8 +653,8 @@ private:
             return;
         }
 
-        NativeWindow native_window{*buffer_queue_id};
-        const auto buffer_size = ctx.WriteBuffer(native_window.Serialize());
+        const auto parcel = android::Parcel{NativeWindow{*buffer_queue_id}};
+        const auto buffer_size = ctx.WriteBuffer(parcel.Serialize());
 
         IPC::ResponseBuilder rb{ctx, 6};
         rb.Push(ResultSuccess);
@@ -1287,39 +770,9 @@ private:
     }
 
     NVFlinger::NVFlinger& nv_flinger;
+    NVFlinger::HosBinderDriverServer& hos_binder_driver_server;
 };
 
-IApplicationDisplayService::IApplicationDisplayService(Core::System& system_,
-                                                       NVFlinger::NVFlinger& nv_flinger_)
-    : ServiceFramework{system_, "IApplicationDisplayService"}, nv_flinger{nv_flinger_} {
-    static const FunctionInfo functions[] = {
-        {100, &IApplicationDisplayService::GetRelayService, "GetRelayService"},
-        {101, &IApplicationDisplayService::GetSystemDisplayService, "GetSystemDisplayService"},
-        {102, &IApplicationDisplayService::GetManagerDisplayService, "GetManagerDisplayService"},
-        {103, &IApplicationDisplayService::GetIndirectDisplayTransactionService,
-         "GetIndirectDisplayTransactionService"},
-        {1000, &IApplicationDisplayService::ListDisplays, "ListDisplays"},
-        {1010, &IApplicationDisplayService::OpenDisplay, "OpenDisplay"},
-        {1011, &IApplicationDisplayService::OpenDefaultDisplay, "OpenDefaultDisplay"},
-        {1020, &IApplicationDisplayService::CloseDisplay, "CloseDisplay"},
-        {1101, &IApplicationDisplayService::SetDisplayEnabled, "SetDisplayEnabled"},
-        {1102, &IApplicationDisplayService::GetDisplayResolution, "GetDisplayResolution"},
-        {2020, &IApplicationDisplayService::OpenLayer, "OpenLayer"},
-        {2021, &IApplicationDisplayService::CloseLayer, "CloseLayer"},
-        {2030, &IApplicationDisplayService::CreateStrayLayer, "CreateStrayLayer"},
-        {2031, &IApplicationDisplayService::DestroyStrayLayer, "DestroyStrayLayer"},
-        {2101, &IApplicationDisplayService::SetLayerScalingMode, "SetLayerScalingMode"},
-        {2102, &IApplicationDisplayService::ConvertScalingMode, "ConvertScalingMode"},
-        {2450, &IApplicationDisplayService::GetIndirectLayerImageMap, "GetIndirectLayerImageMap"},
-        {2451, nullptr, "GetIndirectLayerImageCropMap"},
-        {2460, &IApplicationDisplayService::GetIndirectLayerImageRequiredMemoryInfo,
-         "GetIndirectLayerImageRequiredMemoryInfo"},
-        {5202, &IApplicationDisplayService::GetDisplayVsyncEvent, "GetDisplayVsyncEvent"},
-        {5203, nullptr, "GetDisplayVsyncEventForDebug"},
-    };
-    RegisterHandlers(functions);
-}
-
 static bool IsValidServiceAccess(Permission permission, Policy policy) {
     if (permission == Permission::User) {
         return policy == Policy::User;
@@ -1333,7 +786,9 @@ static bool IsValidServiceAccess(Permission permission, Policy policy) {
 }
 
 void detail::GetDisplayServiceImpl(Kernel::HLERequestContext& ctx, Core::System& system,
-                                   NVFlinger::NVFlinger& nv_flinger, Permission permission) {
+                                   NVFlinger::NVFlinger& nv_flinger,
+                                   NVFlinger::HosBinderDriverServer& hos_binder_driver_server,
+                                   Permission permission) {
     IPC::RequestParser rp{ctx};
     const auto policy = rp.PopEnum<Policy>();
 
@@ -1346,14 +801,18 @@ void detail::GetDisplayServiceImpl(Kernel::HLERequestContext& ctx, Core::System&
 
     IPC::ResponseBuilder rb{ctx, 2, 0, 1};
     rb.Push(ResultSuccess);
-    rb.PushIpcInterface<IApplicationDisplayService>(system, nv_flinger);
+    rb.PushIpcInterface<IApplicationDisplayService>(system, nv_flinger, hos_binder_driver_server);
 }
 
 void InstallInterfaces(SM::ServiceManager& service_manager, Core::System& system,
-                       NVFlinger::NVFlinger& nv_flinger) {
-    std::make_shared<VI_M>(system, nv_flinger)->InstallAsService(service_manager);
-    std::make_shared<VI_S>(system, nv_flinger)->InstallAsService(service_manager);
-    std::make_shared<VI_U>(system, nv_flinger)->InstallAsService(service_manager);
+                       NVFlinger::NVFlinger& nv_flinger,
+                       NVFlinger::HosBinderDriverServer& hos_binder_driver_server) {
+    std::make_shared<VI_M>(system, nv_flinger, hos_binder_driver_server)
+        ->InstallAsService(service_manager);
+    std::make_shared<VI_S>(system, nv_flinger, hos_binder_driver_server)
+        ->InstallAsService(service_manager);
+    std::make_shared<VI_U>(system, nv_flinger, hos_binder_driver_server)
+        ->InstallAsService(service_manager);
 }
 
 } // namespace Service::VI
diff --git a/src/core/hle/service/vi/vi.h b/src/core/hle/service/vi/vi.h
index 2fd7f8e61..d68f2646b 100644
--- a/src/core/hle/service/vi/vi.h
+++ b/src/core/hle/service/vi/vi.h
@@ -15,8 +15,9 @@ class HLERequestContext;
 }
 
 namespace Service::NVFlinger {
+class HosBinderDriverServer;
 class NVFlinger;
-}
+} // namespace Service::NVFlinger
 
 namespace Service::SM {
 class ServiceManager;
@@ -47,11 +48,14 @@ enum class Policy {
 
 namespace detail {
 void GetDisplayServiceImpl(Kernel::HLERequestContext& ctx, Core::System& system,
-                           NVFlinger::NVFlinger& nv_flinger, Permission permission);
+                           NVFlinger::NVFlinger& nv_flinger,
+                           NVFlinger::HosBinderDriverServer& hos_binder_driver_server,
+                           Permission permission);
 } // namespace detail
 
 /// Registers all VI services with the specified service manager.
 void InstallInterfaces(SM::ServiceManager& service_manager, Core::System& system,
-                       NVFlinger::NVFlinger& nv_flinger);
+                       NVFlinger::NVFlinger& nv_flinger,
+                       NVFlinger::HosBinderDriverServer& hos_binder_driver_server);
 
 } // namespace Service::VI
diff --git a/src/core/hle/service/vi/vi_m.cpp b/src/core/hle/service/vi/vi_m.cpp
index 87db1c416..be0255f3d 100644
--- a/src/core/hle/service/vi/vi_m.cpp
+++ b/src/core/hle/service/vi/vi_m.cpp
@@ -8,8 +8,10 @@
 
 namespace Service::VI {
 
-VI_M::VI_M(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_)
-    : ServiceFramework{system_, "vi:m"}, nv_flinger{nv_flinger_} {
+VI_M::VI_M(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_,
+           NVFlinger::HosBinderDriverServer& hos_binder_driver_server_)
+    : ServiceFramework{system_, "vi:m"}, nv_flinger{nv_flinger_}, hos_binder_driver_server{
+                                                                      hos_binder_driver_server_} {
     static const FunctionInfo functions[] = {
         {2, &VI_M::GetDisplayService, "GetDisplayService"},
         {3, nullptr, "GetDisplayServiceWithProxyNameExchange"},
@@ -22,7 +24,8 @@ VI_M::~VI_M() = default;
 void VI_M::GetDisplayService(Kernel::HLERequestContext& ctx) {
     LOG_DEBUG(Service_VI, "called");
 
-    detail::GetDisplayServiceImpl(ctx, system, nv_flinger, Permission::Manager);
+    detail::GetDisplayServiceImpl(ctx, system, nv_flinger, hos_binder_driver_server,
+                                  Permission::Manager);
 }
 
 } // namespace Service::VI
diff --git a/src/core/hle/service/vi/vi_m.h b/src/core/hle/service/vi/vi_m.h
index d79c41beb..efbd34e09 100644
--- a/src/core/hle/service/vi/vi_m.h
+++ b/src/core/hle/service/vi/vi_m.h
@@ -15,20 +15,23 @@ class HLERequestContext;
 }
 
 namespace Service::NVFlinger {
+class HosBinderDriverServer;
 class NVFlinger;
-}
+} // namespace Service::NVFlinger
 
 namespace Service::VI {
 
 class VI_M final : public ServiceFramework<VI_M> {
 public:
-    explicit VI_M(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_);
+    explicit VI_M(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_,
+                  NVFlinger::HosBinderDriverServer& hos_binder_driver_server_);
     ~VI_M() override;
 
 private:
     void GetDisplayService(Kernel::HLERequestContext& ctx);
 
     NVFlinger::NVFlinger& nv_flinger;
+    NVFlinger::HosBinderDriverServer& hos_binder_driver_server;
 };
 
 } // namespace Service::VI
diff --git a/src/core/hle/service/vi/vi_s.cpp b/src/core/hle/service/vi/vi_s.cpp
index 5cd22f7df..7996a6811 100644
--- a/src/core/hle/service/vi/vi_s.cpp
+++ b/src/core/hle/service/vi/vi_s.cpp
@@ -8,8 +8,10 @@
 
 namespace Service::VI {
 
-VI_S::VI_S(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_)
-    : ServiceFramework{system_, "vi:s"}, nv_flinger{nv_flinger_} {
+VI_S::VI_S(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_,
+           NVFlinger::HosBinderDriverServer& hos_binder_driver_server_)
+    : ServiceFramework{system_, "vi:s"}, nv_flinger{nv_flinger_}, hos_binder_driver_server{
+                                                                      hos_binder_driver_server_} {
     static const FunctionInfo functions[] = {
         {1, &VI_S::GetDisplayService, "GetDisplayService"},
         {3, nullptr, "GetDisplayServiceWithProxyNameExchange"},
@@ -22,7 +24,8 @@ VI_S::~VI_S() = default;
 void VI_S::GetDisplayService(Kernel::HLERequestContext& ctx) {
     LOG_DEBUG(Service_VI, "called");
 
-    detail::GetDisplayServiceImpl(ctx, system, nv_flinger, Permission::System);
+    detail::GetDisplayServiceImpl(ctx, system, nv_flinger, hos_binder_driver_server,
+                                  Permission::System);
 }
 
 } // namespace Service::VI
diff --git a/src/core/hle/service/vi/vi_s.h b/src/core/hle/service/vi/vi_s.h
index 5f1f8f290..3812c5061 100644
--- a/src/core/hle/service/vi/vi_s.h
+++ b/src/core/hle/service/vi/vi_s.h
@@ -15,20 +15,23 @@ class HLERequestContext;
 }
 
 namespace Service::NVFlinger {
+class HosBinderDriverServer;
 class NVFlinger;
-}
+} // namespace Service::NVFlinger
 
 namespace Service::VI {
 
 class VI_S final : public ServiceFramework<VI_S> {
 public:
-    explicit VI_S(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_);
+    explicit VI_S(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_,
+                  NVFlinger::HosBinderDriverServer& hos_binder_driver_server_);
     ~VI_S() override;
 
 private:
     void GetDisplayService(Kernel::HLERequestContext& ctx);
 
     NVFlinger::NVFlinger& nv_flinger;
+    NVFlinger::HosBinderDriverServer& hos_binder_driver_server;
 };
 
 } // namespace Service::VI
diff --git a/src/core/hle/service/vi/vi_u.cpp b/src/core/hle/service/vi/vi_u.cpp
index 0079d51f0..57c888313 100644
--- a/src/core/hle/service/vi/vi_u.cpp
+++ b/src/core/hle/service/vi/vi_u.cpp
@@ -8,8 +8,10 @@
 
 namespace Service::VI {
 
-VI_U::VI_U(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_)
-    : ServiceFramework{system_, "vi:u"}, nv_flinger{nv_flinger_} {
+VI_U::VI_U(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_,
+           NVFlinger::HosBinderDriverServer& hos_binder_driver_server_)
+    : ServiceFramework{system_, "vi:u"}, nv_flinger{nv_flinger_}, hos_binder_driver_server{
+                                                                      hos_binder_driver_server_} {
     static const FunctionInfo functions[] = {
         {0, &VI_U::GetDisplayService, "GetDisplayService"},
         {1, nullptr, "GetDisplayServiceWithProxyNameExchange"},
@@ -22,7 +24,8 @@ VI_U::~VI_U() = default;
 void VI_U::GetDisplayService(Kernel::HLERequestContext& ctx) {
     LOG_DEBUG(Service_VI, "called");
 
-    detail::GetDisplayServiceImpl(ctx, system, nv_flinger, Permission::User);
+    detail::GetDisplayServiceImpl(ctx, system, nv_flinger, hos_binder_driver_server,
+                                  Permission::User);
 }
 
 } // namespace Service::VI
diff --git a/src/core/hle/service/vi/vi_u.h b/src/core/hle/service/vi/vi_u.h
index 8e3885c73..b08e56576 100644
--- a/src/core/hle/service/vi/vi_u.h
+++ b/src/core/hle/service/vi/vi_u.h
@@ -15,20 +15,23 @@ class HLERequestContext;
 }
 
 namespace Service::NVFlinger {
+class HosBinderDriverServer;
 class NVFlinger;
-}
+} // namespace Service::NVFlinger
 
 namespace Service::VI {
 
 class VI_U final : public ServiceFramework<VI_U> {
 public:
-    explicit VI_U(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_);
+    explicit VI_U(Core::System& system_, NVFlinger::NVFlinger& nv_flinger_,
+                  NVFlinger::HosBinderDriverServer& hos_binder_driver_server_);
     ~VI_U() override;
 
 private:
     void GetDisplayService(Kernel::HLERequestContext& ctx);
 
     NVFlinger::NVFlinger& nv_flinger;
+    NVFlinger::HosBinderDriverServer& hos_binder_driver_server;
 };
 
 } // namespace Service::VI
diff --git a/src/core/network/network.cpp b/src/core/network/network.cpp
index a3e0664b9..0784a165d 100644
--- a/src/core/network/network.cpp
+++ b/src/core/network/network.cpp
@@ -600,6 +600,10 @@ Errno Socket::SetReuseAddr(bool enable) {
     return SetSockOpt<u32>(fd, SO_REUSEADDR, enable ? 1 : 0);
 }
 
+Errno Socket::SetKeepAlive(bool enable) {
+    return SetSockOpt<u32>(fd, SO_KEEPALIVE, enable ? 1 : 0);
+}
+
 Errno Socket::SetBroadcast(bool enable) {
     return SetSockOpt<u32>(fd, SO_BROADCAST, enable ? 1 : 0);
 }
diff --git a/src/core/network/sockets.h b/src/core/network/sockets.h
index a44393325..caaefce7c 100644
--- a/src/core/network/sockets.h
+++ b/src/core/network/sockets.h
@@ -8,7 +8,6 @@
 #include <utility>
 
 #if defined(_WIN32)
-#include <winsock.h>
 #elif !YUZU_UNIX
 #error "Platform not implemented"
 #endif
@@ -68,6 +67,8 @@ public:
 
     Errno SetReuseAddr(bool enable);
 
+    Errno SetKeepAlive(bool enable);
+
     Errno SetBroadcast(bool enable);
 
     Errno SetSndBuf(u32 value);
diff --git a/src/core/perf_stats.cpp b/src/core/perf_stats.cpp
index 52c43c857..6ef459b7a 100644
--- a/src/core/perf_stats.cpp
+++ b/src/core/perf_stats.cpp
@@ -53,13 +53,13 @@ PerfStats::~PerfStats() {
 }
 
 void PerfStats::BeginSystemFrame() {
-    std::lock_guard lock{object_mutex};
+    std::scoped_lock lock{object_mutex};
 
     frame_begin = Clock::now();
 }
 
 void PerfStats::EndSystemFrame() {
-    std::lock_guard lock{object_mutex};
+    std::scoped_lock lock{object_mutex};
 
     auto frame_end = Clock::now();
     const auto frame_time = frame_end - frame_begin;
@@ -79,7 +79,7 @@ void PerfStats::EndGameFrame() {
 }
 
 double PerfStats::GetMeanFrametime() const {
-    std::lock_guard lock{object_mutex};
+    std::scoped_lock lock{object_mutex};
 
     if (current_index <= IgnoreFrames) {
         return 0;
@@ -91,7 +91,7 @@ double PerfStats::GetMeanFrametime() const {
 }
 
 PerfStatsResults PerfStats::GetAndResetStats(microseconds current_system_time_us) {
-    std::lock_guard lock{object_mutex};
+    std::scoped_lock lock{object_mutex};
 
     const auto now = Clock::now();
     // Walltime elapsed since stats were reset
@@ -120,7 +120,7 @@ PerfStatsResults PerfStats::GetAndResetStats(microseconds current_system_time_us
 }
 
 double PerfStats::GetLastFrameTimeScale() const {
-    std::lock_guard lock{object_mutex};
+    std::scoped_lock lock{object_mutex};
 
     constexpr double FRAME_LENGTH = 1.0 / 60;
     return duration_cast<DoubleSecs>(previous_frame_length).count() / FRAME_LENGTH;
diff --git a/src/core/reporter.cpp b/src/core/reporter.cpp
index d4becdc0a..89faed6ee 100644
--- a/src/core/reporter.cpp
+++ b/src/core/reporter.cpp
@@ -8,7 +8,6 @@
 
 #include <fmt/chrono.h>
 #include <fmt/format.h>
-#include <fmt/ostream.h>
 #include <nlohmann/json.hpp>
 
 #include "common/fs/file.h"
diff --git a/src/core/tools/freezer.cpp b/src/core/tools/freezer.cpp
index 032c71aff..c81dc0e52 100644
--- a/src/core/tools/freezer.cpp
+++ b/src/core/tools/freezer.cpp
@@ -80,7 +80,7 @@ bool Freezer::IsActive() const {
 }
 
 void Freezer::Clear() {
-    std::lock_guard lock{entries_mutex};
+    std::scoped_lock lock{entries_mutex};
 
     LOG_DEBUG(Common_Memory, "Clearing all frozen memory values.");
 
@@ -88,7 +88,7 @@ void Freezer::Clear() {
 }
 
 u64 Freezer::Freeze(VAddr address, u32 width) {
-    std::lock_guard lock{entries_mutex};
+    std::scoped_lock lock{entries_mutex};
 
     const auto current_value = MemoryReadWidth(memory, width, address);
     entries.push_back({address, width, current_value});
@@ -101,7 +101,7 @@ u64 Freezer::Freeze(VAddr address, u32 width) {
 }
 
 void Freezer::Unfreeze(VAddr address) {
-    std::lock_guard lock{entries_mutex};
+    std::scoped_lock lock{entries_mutex};
 
     LOG_DEBUG(Common_Memory, "Unfreezing memory for address={:016X}", address);
 
@@ -109,13 +109,13 @@ void Freezer::Unfreeze(VAddr address) {
 }
 
 bool Freezer::IsFrozen(VAddr address) const {
-    std::lock_guard lock{entries_mutex};
+    std::scoped_lock lock{entries_mutex};
 
     return FindEntry(address) != entries.cend();
 }
 
 void Freezer::SetFrozenValue(VAddr address, u64 value) {
-    std::lock_guard lock{entries_mutex};
+    std::scoped_lock lock{entries_mutex};
 
     const auto iter = FindEntry(address);
 
@@ -132,7 +132,7 @@ void Freezer::SetFrozenValue(VAddr address, u64 value) {
 }
 
 std::optional<Freezer::Entry> Freezer::GetEntry(VAddr address) const {
-    std::lock_guard lock{entries_mutex};
+    std::scoped_lock lock{entries_mutex};
 
     const auto iter = FindEntry(address);
 
@@ -144,7 +144,7 @@ std::optional<Freezer::Entry> Freezer::GetEntry(VAddr address) const {
 }
 
 std::vector<Freezer::Entry> Freezer::GetEntries() const {
-    std::lock_guard lock{entries_mutex};
+    std::scoped_lock lock{entries_mutex};
 
     return entries;
 }
@@ -165,7 +165,7 @@ void Freezer::FrameCallback(std::uintptr_t, std::chrono::nanoseconds ns_late) {
         return;
     }
 
-    std::lock_guard lock{entries_mutex};
+    std::scoped_lock lock{entries_mutex};
 
     for (const auto& entry : entries) {
         LOG_DEBUG(Common_Memory,
@@ -178,7 +178,7 @@ void Freezer::FrameCallback(std::uintptr_t, std::chrono::nanoseconds ns_late) {
 }
 
 void Freezer::FillEntryReads() {
-    std::lock_guard lock{entries_mutex};
+    std::scoped_lock lock{entries_mutex};
 
     LOG_DEBUG(Common_Memory, "Updating memory freeze entries to current values.");