18 files changed, 517 insertions, 612 deletions

diff --git a/src/core/debugger/gdbstub_arch.cpp b/src/core/debugger/gdbstub_arch.cpp
index f2a407dc8..452f565be 100644
--- a/src/core/debugger/gdbstub_arch.cpp
+++ b/src/core/debugger/gdbstub_arch.cpp
@@ -383,7 +383,7 @@ std::string GDBStubA32::RegRead(const Kernel::KThread* thread, size_t id) const
     } else if (id == CPSR_REGISTER) {
         return ValueToHex(context.pstate);
     } else if (id >= D0_REGISTER && id < Q0_REGISTER) {
-        return ValueToHex(fprs[id - D0_REGISTER][0]);
+        return ValueToHex(fprs[(id - D0_REGISTER) / 2][(id - D0_REGISTER) % 2]);
     } else if (id >= Q0_REGISTER && id < FPSCR_REGISTER) {
         return ValueToHex(fprs[id - Q0_REGISTER]);
     } else if (id == FPSCR_REGISTER) {
@@ -406,7 +406,7 @@ void GDBStubA32::RegWrite(Kernel::KThread* thread, size_t id, std::string_view v
     } else if (id == CPSR_REGISTER) {
         context.pstate = HexToValue<u32>(value);
     } else if (id >= D0_REGISTER && id < Q0_REGISTER) {
-        fprs[id - D0_REGISTER] = {HexToValue<u64>(value), 0};
+        fprs[(id - D0_REGISTER) / 2][(id - D0_REGISTER) % 2] = HexToValue<u64>(value);
     } else if (id >= Q0_REGISTER && id < FPSCR_REGISTER) {
         fprs[id - Q0_REGISTER] = HexToValue<u128>(value);
     } else if (id == FPSCR_REGISTER) {
diff --git a/src/core/hle/service/cmif_serialization.h b/src/core/hle/service/cmif_serialization.h
index 315475e71..e985fe317 100644
--- a/src/core/hle/service/cmif_serialization.h
+++ b/src/core/hle/service/cmif_serialization.h
@@ -115,6 +115,11 @@ struct ArgumentTraits {
     static constexpr ArgumentType Type = ArgumentType::InData;
 };
 
+template <typename... Ts>
+consteval bool ConstIfReference() {
+    return ((!std::is_reference_v<Ts> || std::is_const_v<std::remove_reference_t<Ts>>) && ... && true);
+}
+
 struct RequestLayout {
     u32 copy_handle_count;
     u32 move_handle_count;
@@ -435,6 +440,7 @@ void CmifReplyWrapImpl(HLERequestContext& ctx, T& t, Result (T::*f)(A...)) {
     }
     const bool is_domain = Domain ? ctx.GetManager()->IsDomain() : false;
 
+    static_assert(ConstIfReference<A...>(), "Arguments taken by reference must be const");
     using MethodArguments = std::tuple<std::remove_cvref_t<A>...>;
 
     OutTemporaryBuffers buffers{};
diff --git a/src/core/hle/service/cmif_types.h b/src/core/hle/service/cmif_types.h
index dc06169f4..84f4c2456 100644
--- a/src/core/hle/service/cmif_types.h
+++ b/src/core/hle/service/cmif_types.h
@@ -4,10 +4,9 @@
 #pragma once
 
 #include <memory>
+#include <span>
 
-#include "common/common_funcs.h"
 #include "common/common_types.h"
-#include "core/hle/service/hle_ipc.h"
 
 namespace Service {
 
@@ -22,8 +21,10 @@ class Out {
 public:
     using Type = T;
 
+    /* implicit */ Out(const Out& t) : raw(t.raw) {}
     /* implicit */ Out(AutoOut<Type>& t) : raw(&t.raw) {}
     /* implicit */ Out(Type* t) : raw(t) {}
+    Out& operator=(const Out&) = delete;
 
     Type* Get() const {
         return raw;
@@ -37,6 +38,10 @@ public:
         return raw;
     }
 
+    operator Type*() const {
+        return raw;
+    }
+
 private:
     Type* raw;
 };
@@ -113,8 +118,10 @@ class OutCopyHandle {
 public:
     using Type = T*;
 
+    /* implicit */ OutCopyHandle(const OutCopyHandle& t) : raw(t.raw) {}
     /* implicit */ OutCopyHandle(AutoOut<Type>& t) : raw(&t.raw) {}
     /* implicit */ OutCopyHandle(Type* t) : raw(t) {}
+    OutCopyHandle& operator=(const OutCopyHandle&) = delete;
 
     Type* Get() const {
         return raw;
@@ -128,6 +135,10 @@ public:
         return raw;
     }
 
+    operator Type*() const {
+        return raw;
+    }
+
 private:
     Type* raw;
 };
@@ -137,8 +148,10 @@ class OutMoveHandle {
 public:
     using Type = T*;
 
+    /* implicit */ OutMoveHandle(const OutMoveHandle& t) : raw(t.raw) {}
     /* implicit */ OutMoveHandle(AutoOut<Type>& t) : raw(&t.raw) {}
     /* implicit */ OutMoveHandle(Type* t) : raw(t) {}
+    OutMoveHandle& operator=(const OutMoveHandle&) = delete;
 
     Type* Get() const {
         return raw;
@@ -152,6 +165,10 @@ public:
         return raw;
     }
 
+    operator Type*() const {
+        return raw;
+    }
+
 private:
     Type* raw;
 };
@@ -248,8 +265,10 @@ public:
     static constexpr BufferAttr Attr = static_cast<BufferAttr>(A | BufferAttr_In | BufferAttr_FixedSize);
     using Type = T;
 
+    /* implicit */ OutLargeData(const OutLargeData& t) : raw(t.raw) {}
     /* implicit */ OutLargeData(Type* t) : raw(t) {}
     /* implicit */ OutLargeData(AutoOut<T>& t) : raw(&t.raw) {}
+    OutLargeData& operator=(const OutLargeData&) = delete;
 
     Type* Get() const {
         return raw;
@@ -263,6 +282,10 @@ public:
         return raw;
     }
 
+    operator Type*() const {
+        return raw;
+    }
+
 private:
     Type* raw;
 };
diff --git a/src/core/hle/service/filesystem/fsp/fsp_srv.cpp b/src/core/hle/service/filesystem/fsp/fsp_srv.cpp
index 5fe534c73..63c2d3a58 100644
--- a/src/core/hle/service/filesystem/fsp/fsp_srv.cpp
+++ b/src/core/hle/service/filesystem/fsp/fsp_srv.cpp
@@ -115,6 +115,11 @@ private:
             if (type->GetName() == "save") {
                 for (const auto& save_id : type->GetSubdirectories()) {
                     for (const auto& user_id : save_id->GetSubdirectories()) {
+                        // Skip non user id subdirectories
+                        if (user_id->GetName().size() != 0x20) {
+                            continue;
+                        }
+
                         const auto save_id_numeric = stoull_be(save_id->GetName());
                         auto user_id_numeric = Common::HexStringToArray<0x10>(user_id->GetName());
                         std::reverse(user_id_numeric.begin(), user_id_numeric.end());
@@ -160,6 +165,10 @@ private:
             } else if (space == FileSys::SaveDataSpaceId::TemporaryStorage) {
                 // Temporary Storage
                 for (const auto& user_id : type->GetSubdirectories()) {
+                    // Skip non user id subdirectories
+                    if (user_id->GetName().size() != 0x20) {
+                        continue;
+                    }
                     for (const auto& title_id : user_id->GetSubdirectories()) {
                         if (!title_id->GetFiles().empty() ||
                             !title_id->GetSubdirectories().empty()) {
diff --git a/src/core/hle/service/glue/time/time_zone_binary.cpp b/src/core/hle/service/glue/time/time_zone_binary.cpp
index d5f7ca3d2..18c6abd6b 100644
--- a/src/core/hle/service/glue/time/time_zone_binary.cpp
+++ b/src/core/hle/service/glue/time/time_zone_binary.cpp
@@ -65,6 +65,7 @@ Result MountTimeZoneBinary(Core::System& system) {
         // Validate that the romfs is readable, using invalid firmware keys can cause this to get
         // set but the files to be garbage. In that case, we want to hit the next path and
         // synthesise them instead.
+        g_time_zone_binary_mount_result = ResultSuccess;
         Service::PSC::Time::LocationName name{"Etc/GMT"};
         if (!IsTimeZoneBinaryValid(name)) {
             ResetTimeZoneBinary();
diff --git a/src/core/hle/service/hid/hid_debug_server.cpp b/src/core/hle/service/hid/hid_debug_server.cpp
index 610af34dd..4e2663672 100644
--- a/src/core/hle/service/hid/hid_debug_server.cpp
+++ b/src/core/hle/service/hid/hid_debug_server.cpp
@@ -3,6 +3,7 @@
 
 #include <algorithm>
 
+#include "core/hle/service/cmif_serialization.h"
 #include "core/hle/service/hid/hid_debug_server.h"
 #include "core/hle/service/ipc_helpers.h"
 #include "hid_core/hid_types.h"
@@ -11,7 +12,6 @@
 
 #include "hid_core/resources/touch_screen/gesture.h"
 #include "hid_core/resources/touch_screen/touch_screen.h"
-#include "hid_core/resources/touch_screen/touch_types.h"
 
 namespace Service::HID {
 
@@ -24,14 +24,14 @@ IHidDebugServer::IHidDebugServer(Core::System& system_, std::shared_ptr<Resource
         {0, nullptr, "DeactivateDebugPad"},
         {1, nullptr, "SetDebugPadAutoPilotState"},
         {2, nullptr, "UnsetDebugPadAutoPilotState"},
-        {10, &IHidDebugServer::DeactivateTouchScreen, "DeactivateTouchScreen"},
-        {11, &IHidDebugServer::SetTouchScreenAutoPilotState, "SetTouchScreenAutoPilotState"},
-        {12, &IHidDebugServer::UnsetTouchScreenAutoPilotState, "UnsetTouchScreenAutoPilotState"},
-        {13, &IHidDebugServer::GetTouchScreenConfiguration, "GetTouchScreenConfiguration"},
-        {14, &IHidDebugServer::ProcessTouchScreenAutoTune, "ProcessTouchScreenAutoTune"},
-        {15, &IHidDebugServer::ForceStopTouchScreenManagement, "ForceStopTouchScreenManagement"},
-        {16, &IHidDebugServer::ForceRestartTouchScreenManagement, "ForceRestartTouchScreenManagement"},
-        {17, &IHidDebugServer::IsTouchScreenManaged, "IsTouchScreenManaged"},
+        {10, C<&IHidDebugServer::DeactivateTouchScreen>, "DeactivateTouchScreen"},
+        {11, C<&IHidDebugServer::SetTouchScreenAutoPilotState>, "SetTouchScreenAutoPilotState"},
+        {12, C<&IHidDebugServer::UnsetTouchScreenAutoPilotState>, "UnsetTouchScreenAutoPilotState"},
+        {13, C<&IHidDebugServer::GetTouchScreenConfiguration>, "GetTouchScreenConfiguration"},
+        {14, C<&IHidDebugServer::ProcessTouchScreenAutoTune>, "ProcessTouchScreenAutoTune"},
+        {15, C<&IHidDebugServer::ForceStopTouchScreenManagement>, "ForceStopTouchScreenManagement"},
+        {16, C<&IHidDebugServer::ForceRestartTouchScreenManagement>, "ForceRestartTouchScreenManagement"},
+        {17, C<&IHidDebugServer::IsTouchScreenManaged>, "IsTouchScreenManaged"},
         {20, nullptr, "DeactivateMouse"},
         {21, nullptr, "SetMouseAutoPilotState"},
         {22, nullptr, "UnsetMouseAutoPilotState"},
@@ -47,7 +47,7 @@ IHidDebugServer::IHidDebugServer(Core::System& system_, std::shared_ptr<Resource
         {60, nullptr, "ClearNpadSystemCommonPolicy"},
         {61, nullptr, "DeactivateNpad"},
         {62, nullptr, "ForceDisconnectNpad"},
-        {91, &IHidDebugServer::DeactivateGesture, "DeactivateGesture"},
+        {91, C<&IHidDebugServer::DeactivateGesture>, "DeactivateGesture"},
         {110, nullptr, "DeactivateHomeButton"},
         {111, nullptr, "SetHomeButtonAutoPilotState"},
         {112, nullptr, "UnsetHomeButtonAutoPilotState"},
@@ -160,169 +160,122 @@ IHidDebugServer::IHidDebugServer(Core::System& system_, std::shared_ptr<Resource
 }
 
 IHidDebugServer::~IHidDebugServer() = default;
-void IHidDebugServer::DeactivateTouchScreen(HLERequestContext& ctx) {
-    LOG_INFO(Service_HID, "called");
 
-    Result result = ResultSuccess;
+Result IHidDebugServer::DeactivateTouchScreen() {
+    LOG_INFO(Service_HID, "called");
 
     if (!firmware_settings->IsDeviceManaged()) {
-        result = GetResourceManager()->GetTouchScreen()->Deactivate();
+        R_RETURN(GetResourceManager()->GetTouchScreen()->Deactivate());
     }
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
+    R_SUCCEED();
 }
 
-void IHidDebugServer::SetTouchScreenAutoPilotState(HLERequestContext& ctx) {
+Result IHidDebugServer::SetTouchScreenAutoPilotState(
+    InArray<TouchState, BufferAttr_HipcMapAlias> auto_pilot_buffer) {
     AutoPilotState auto_pilot{};
-    auto_pilot.count = ctx.GetReadBufferNumElements<TouchState>();
-    const auto buffer = ctx.ReadBuffer();
 
-    auto_pilot.count = std::min(auto_pilot.count, static_cast<u64>(auto_pilot.state.size()));
-    memcpy(auto_pilot.state.data(), buffer.data(), auto_pilot.count * sizeof(TouchState));
+    auto_pilot.count =
+        static_cast<u64>(std::min(auto_pilot_buffer.size(), auto_pilot.state.size()));
+    memcpy(auto_pilot.state.data(), auto_pilot_buffer.data(),
+           auto_pilot.count * sizeof(TouchState));
 
     LOG_INFO(Service_HID, "called, auto_pilot_count={}", auto_pilot.count);
 
-    const Result result =
-        GetResourceManager()->GetTouchScreen()->SetTouchScreenAutoPilotState(auto_pilot);
-
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
+    R_RETURN(GetResourceManager()->GetTouchScreen()->SetTouchScreenAutoPilotState(auto_pilot));
 }
 
-void IHidDebugServer::UnsetTouchScreenAutoPilotState(HLERequestContext& ctx) {
+Result IHidDebugServer::UnsetTouchScreenAutoPilotState() {
     LOG_INFO(Service_HID, "called");
-
-    const Result result = GetResourceManager()->GetTouchScreen()->UnsetTouchScreenAutoPilotState();
-
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
+    R_RETURN(GetResourceManager()->GetTouchScreen()->UnsetTouchScreenAutoPilotState());
 }
 
-void IHidDebugServer::GetTouchScreenConfiguration(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    const auto applet_resource_user_id{rp.Pop<u64>()};
-
-    LOG_INFO(Service_HID, "called, applet_resource_user_id={}", applet_resource_user_id);
+Result IHidDebugServer::GetTouchScreenConfiguration(
+    Out<Core::HID::TouchScreenConfigurationForNx> out_touchscreen_config,
+    ClientAppletResourceUserId aruid) {
+    LOG_INFO(Service_HID, "called, applet_resource_user_id={}", aruid.pid);
 
-    Core::HID::TouchScreenConfigurationForNx touchscreen_config{};
-    const Result result = GetResourceManager()->GetTouchScreen()->GetTouchScreenConfiguration(
-        touchscreen_config, applet_resource_user_id);
+    R_TRY(GetResourceManager()->GetTouchScreen()->GetTouchScreenConfiguration(
+        *out_touchscreen_config, aruid.pid));
 
-    if (touchscreen_config.mode != Core::HID::TouchScreenModeForNx::Heat2 &&
-        touchscreen_config.mode != Core::HID::TouchScreenModeForNx::Finger) {
-        touchscreen_config.mode = Core::HID::TouchScreenModeForNx::UseSystemSetting;
+    if (out_touchscreen_config->mode != Core::HID::TouchScreenModeForNx::Heat2 &&
+        out_touchscreen_config->mode != Core::HID::TouchScreenModeForNx::Finger) {
+        out_touchscreen_config->mode = Core::HID::TouchScreenModeForNx::UseSystemSetting;
     }
 
-    IPC::ResponseBuilder rb{ctx, 6};
-    rb.Push(result);
-    rb.PushRaw(touchscreen_config);
+    R_SUCCEED();
 }
 
-void IHidDebugServer::ProcessTouchScreenAutoTune(HLERequestContext& ctx) {
+Result IHidDebugServer::ProcessTouchScreenAutoTune() {
     LOG_INFO(Service_HID, "called");
-
-    Result result = GetResourceManager()->GetTouchScreen()->ProcessTouchScreenAutoTune();
-
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
+    R_RETURN(GetResourceManager()->GetTouchScreen()->ProcessTouchScreenAutoTune());
 }
 
-void IHidDebugServer::ForceStopTouchScreenManagement(HLERequestContext& ctx) {
+Result IHidDebugServer::ForceStopTouchScreenManagement() {
     LOG_INFO(Service_HID, "called");
 
     if (!firmware_settings->IsDeviceManaged()) {
-        IPC::ResponseBuilder rb{ctx, 2};
-        rb.Push(ResultSuccess);
-        return;
+        R_SUCCEED();
     }
 
-    Result result = ResultSuccess;
-    bool is_touch_active{};
-    bool is_gesture_active{};
     auto touch_screen = GetResourceManager()->GetTouchScreen();
     auto gesture = GetResourceManager()->GetGesture();
 
     if (firmware_settings->IsTouchI2cManaged()) {
-        result = touch_screen->IsActive(is_touch_active);
-        if (result.IsSuccess()) {
-            result = gesture->IsActive(is_gesture_active);
-        }
-        if (result.IsSuccess() && is_touch_active) {
-            result = touch_screen->Deactivate();
+        bool is_touch_active{};
+        bool is_gesture_active{};
+        R_TRY(touch_screen->IsActive(is_touch_active));
+        R_TRY(gesture->IsActive(is_gesture_active));
+
+        if (is_touch_active) {
+            R_TRY(touch_screen->Deactivate());
         }
-        if (result.IsSuccess() && is_gesture_active) {
-            result = gesture->Deactivate();
+        if (is_gesture_active) {
+            R_TRY(gesture->Deactivate());
         }
     }
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
+    R_SUCCEED();
 }
 
-void IHidDebugServer::ForceRestartTouchScreenManagement(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    struct Parameters {
-        u32 basic_gesture_id;
-        INSERT_PADDING_WORDS_NOINIT(1);
-        u64 applet_resource_user_id;
-    };
-    static_assert(sizeof(Parameters) == 0x10, "Parameters has incorrect size.");
-
-    const auto parameters{rp.PopRaw<Parameters>()};
-
+Result IHidDebugServer::ForceRestartTouchScreenManagement(u32 basic_gesture_id,
+                                                          ClientAppletResourceUserId aruid) {
     LOG_INFO(Service_HID, "called, basic_gesture_id={}, applet_resource_user_id={}",
-             parameters.basic_gesture_id, parameters.applet_resource_user_id);
+             basic_gesture_id, aruid.pid);
 
-    Result result = ResultSuccess;
     auto touch_screen = GetResourceManager()->GetTouchScreen();
     auto gesture = GetResourceManager()->GetGesture();
 
     if (firmware_settings->IsDeviceManaged() && firmware_settings->IsTouchI2cManaged()) {
-        result = gesture->Activate();
-        if (result.IsSuccess()) {
-            result =
-                gesture->Activate(parameters.applet_resource_user_id, parameters.basic_gesture_id);
-        }
-        if (result.IsSuccess()) {
-            result = touch_screen->Activate();
-        }
-        if (result.IsSuccess()) {
-            result = touch_screen->Activate(parameters.applet_resource_user_id);
-        }
+        R_TRY(gesture->Activate());
+        R_TRY(gesture->Activate(aruid.pid, basic_gesture_id));
+        R_TRY(touch_screen->Activate());
+        R_TRY(touch_screen->Activate(aruid.pid));
     }
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
+    R_SUCCEED();
 }
 
-void IHidDebugServer::IsTouchScreenManaged(HLERequestContext& ctx) {
+Result IHidDebugServer::IsTouchScreenManaged(Out<bool> out_is_managed) {
     LOG_INFO(Service_HID, "called");
 
     bool is_touch_active{};
     bool is_gesture_active{};
+    R_TRY(GetResourceManager()->GetTouchScreen()->IsActive(is_touch_active));
+    R_TRY(GetResourceManager()->GetGesture()->IsActive(is_gesture_active));
 
-    Result result = GetResourceManager()->GetTouchScreen()->IsActive(is_touch_active);
-    if (result.IsSuccess()) {
-        result = GetResourceManager()->GetGesture()->IsActive(is_gesture_active);
-    }
-
-    IPC::ResponseBuilder rb{ctx, 3};
-    rb.Push(result);
-    rb.Push(is_touch_active | is_gesture_active);
+    *out_is_managed = is_touch_active || is_gesture_active;
+    R_SUCCEED();
 }
 
-void IHidDebugServer::DeactivateGesture(HLERequestContext& ctx) {
+Result IHidDebugServer::DeactivateGesture() {
     LOG_INFO(Service_HID, "called");
 
-    Result result = ResultSuccess;
-
     if (!firmware_settings->IsDeviceManaged()) {
-        result = GetResourceManager()->GetGesture()->Deactivate();
+        R_RETURN(GetResourceManager()->GetGesture()->Deactivate());
     }
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
+    R_SUCCEED();
 }
 
 std::shared_ptr<ResourceManager> IHidDebugServer::GetResourceManager() {
diff --git a/src/core/hle/service/hid/hid_debug_server.h b/src/core/hle/service/hid/hid_debug_server.h
index 7d5b082b3..3a483f07e 100644
--- a/src/core/hle/service/hid/hid_debug_server.h
+++ b/src/core/hle/service/hid/hid_debug_server.h
@@ -3,7 +3,9 @@
 
 #pragma once
 
+#include "core/hle/service/cmif_types.h"
 #include "core/hle/service/service.h"
+#include "hid_core/resources/touch_screen/touch_types.h"
 
 namespace Core {
 class System;
@@ -20,15 +22,19 @@ public:
     ~IHidDebugServer() override;
 
 private:
-    void DeactivateTouchScreen(HLERequestContext& ctx);
-    void SetTouchScreenAutoPilotState(HLERequestContext& ctx);
-    void UnsetTouchScreenAutoPilotState(HLERequestContext& ctx);
-    void GetTouchScreenConfiguration(HLERequestContext& ctx);
-    void ProcessTouchScreenAutoTune(HLERequestContext& ctx);
-    void ForceStopTouchScreenManagement(HLERequestContext& ctx);
-    void ForceRestartTouchScreenManagement(HLERequestContext& ctx);
-    void IsTouchScreenManaged(HLERequestContext& ctx);
-    void DeactivateGesture(HLERequestContext& ctx);
+    Result DeactivateTouchScreen();
+    Result SetTouchScreenAutoPilotState(
+        InArray<TouchState, BufferAttr_HipcMapAlias> auto_pilot_buffer);
+    Result UnsetTouchScreenAutoPilotState();
+    Result GetTouchScreenConfiguration(
+        Out<Core::HID::TouchScreenConfigurationForNx> out_touchscreen_config,
+        ClientAppletResourceUserId aruid);
+    Result ProcessTouchScreenAutoTune();
+    Result ForceStopTouchScreenManagement();
+    Result ForceRestartTouchScreenManagement(u32 basic_gesture_id,
+                                             ClientAppletResourceUserId aruid);
+    Result IsTouchScreenManaged(Out<bool> out_is_managed);
+    Result DeactivateGesture();
 
     std::shared_ptr<ResourceManager> GetResourceManager();
 
diff --git a/src/core/hle/service/hid/irs.cpp b/src/core/hle/service/hid/irs.cpp
index 18e544f2f..7d7368ff9 100644
--- a/src/core/hle/service/hid/irs.cpp
+++ b/src/core/hle/service/hid/irs.cpp
@@ -9,6 +9,7 @@
 #include "core/hle/kernel/k_shared_memory.h"
 #include "core/hle/kernel/k_transfer_memory.h"
 #include "core/hle/kernel/kernel.h"
+#include "core/hle/service/cmif_serialization.h"
 #include "core/hle/service/hid/irs.h"
 #include "core/hle/service/ipc_helpers.h"
 #include "core/memory.h"
@@ -28,24 +29,24 @@ namespace Service::IRS {
 IRS::IRS(Core::System& system_) : ServiceFramework{system_, "irs"} {
     // clang-format off
     static const FunctionInfo functions[] = {
-        {302, &IRS::ActivateIrsensor, "ActivateIrsensor"},
-        {303, &IRS::DeactivateIrsensor, "DeactivateIrsensor"},
-        {304, &IRS::GetIrsensorSharedMemoryHandle, "GetIrsensorSharedMemoryHandle"},
-        {305, &IRS::StopImageProcessor, "StopImageProcessor"},
-        {306, &IRS::RunMomentProcessor, "RunMomentProcessor"},
-        {307, &IRS::RunClusteringProcessor, "RunClusteringProcessor"},
-        {308, &IRS::RunImageTransferProcessor, "RunImageTransferProcessor"},
-        {309, &IRS::GetImageTransferProcessorState, "GetImageTransferProcessorState"},
-        {310, &IRS::RunTeraPluginProcessor, "RunTeraPluginProcessor"},
-        {311, &IRS::GetNpadIrCameraHandle, "GetNpadIrCameraHandle"},
-        {312, &IRS::RunPointingProcessor, "RunPointingProcessor"},
-        {313, &IRS::SuspendImageProcessor, "SuspendImageProcessor"},
-        {314, &IRS::CheckFirmwareVersion, "CheckFirmwareVersion"},
-        {315, &IRS::SetFunctionLevel, "SetFunctionLevel"},
-        {316, &IRS::RunImageTransferExProcessor, "RunImageTransferExProcessor"},
-        {317, &IRS::RunIrLedProcessor, "RunIrLedProcessor"},
-        {318, &IRS::StopImageProcessorAsync, "StopImageProcessorAsync"},
-        {319, &IRS::ActivateIrsensorWithFunctionLevel, "ActivateIrsensorWithFunctionLevel"},
+        {302, C<&IRS::ActivateIrsensor>, "ActivateIrsensor"},
+        {303, C<&IRS::DeactivateIrsensor>, "DeactivateIrsensor"},
+        {304, C<&IRS::GetIrsensorSharedMemoryHandle>, "GetIrsensorSharedMemoryHandle"},
+        {305, C<&IRS::StopImageProcessor>, "StopImageProcessor"},
+        {306, C<&IRS::RunMomentProcessor>, "RunMomentProcessor"},
+        {307, C<&IRS::RunClusteringProcessor>, "RunClusteringProcessor"},
+        {308, C<&IRS::RunImageTransferProcessor>, "RunImageTransferProcessor"},
+        {309, C<&IRS::GetImageTransferProcessorState>, "GetImageTransferProcessorState"},
+        {310, C<&IRS::RunTeraPluginProcessor>, "RunTeraPluginProcessor"},
+        {311, C<&IRS::GetNpadIrCameraHandle>, "GetNpadIrCameraHandle"},
+        {312, C<&IRS::RunPointingProcessor>, "RunPointingProcessor"},
+        {313, C<&IRS::SuspendImageProcessor>, "SuspendImageProcessor"},
+        {314, C<&IRS::CheckFirmwareVersion>, "CheckFirmwareVersion"},
+        {315, C<&IRS::SetFunctionLevel>, "SetFunctionLevel"},
+        {316, C<&IRS::RunImageTransferExProcessor>, "RunImageTransferExProcessor"},
+        {317, C<&IRS::RunIrLedProcessor>, "RunIrLedProcessor"},
+        {318, C<&IRS::StopImageProcessorAsync>, "StopImageProcessorAsync"},
+        {319, C<&IRS::ActivateIrsensorWithFunctionLevel>, "ActivateIrsensorWithFunctionLevel"},
     };
     // clang-format on
 
@@ -57,489 +58,292 @@ IRS::IRS(Core::System& system_) : ServiceFramework{system_, "irs"} {
 }
 IRS::~IRS() = default;
 
-void IRS::ActivateIrsensor(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    const auto applet_resource_user_id{rp.Pop<u64>()};
-
-    LOG_WARNING(Service_IRS, "(STUBBED) called, applet_resource_user_id={}",
-                applet_resource_user_id);
-
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(ResultSuccess);
+Result IRS::ActivateIrsensor(ClientAppletResourceUserId aruid) {
+    LOG_WARNING(Service_IRS, "(STUBBED) called, applet_resource_user_id={}", aruid.pid);
+    R_SUCCEED();
 }
 
-void IRS::DeactivateIrsensor(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    const auto applet_resource_user_id{rp.Pop<u64>()};
-
-    LOG_WARNING(Service_IRS, "(STUBBED) called, applet_resource_user_id={}",
-                applet_resource_user_id);
-
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(ResultSuccess);
+Result IRS::DeactivateIrsensor(ClientAppletResourceUserId aruid) {
+    LOG_WARNING(Service_IRS, "(STUBBED) called, applet_resource_user_id={}", aruid.pid);
+    R_SUCCEED();
 }
 
-void IRS::GetIrsensorSharedMemoryHandle(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    const auto applet_resource_user_id{rp.Pop<u64>()};
-
-    LOG_DEBUG(Service_IRS, "called, applet_resource_user_id={}", applet_resource_user_id);
+Result IRS::GetIrsensorSharedMemoryHandle(OutCopyHandle<Kernel::KSharedMemory> out_shared_memory,
+                                          ClientAppletResourceUserId aruid) {
+    LOG_DEBUG(Service_IRS, "called, applet_resource_user_id={}", aruid.pid);
 
-    IPC::ResponseBuilder rb{ctx, 2, 1};
-    rb.Push(ResultSuccess);
-    rb.PushCopyObjects(&system.Kernel().GetIrsSharedMem());
+    *out_shared_memory = &system.Kernel().GetIrsSharedMem();
+    R_SUCCEED();
 }
 
-void IRS::StopImageProcessor(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    struct Parameters {
-        Core::IrSensor::IrCameraHandle camera_handle;
-        INSERT_PADDING_WORDS_NOINIT(1);
-        u64 applet_resource_user_id;
-    };
-    static_assert(sizeof(Parameters) == 0x10, "Parameters has incorrect size.");
-
-    const auto parameters{rp.PopRaw<Parameters>()};
-
+Result IRS::StopImageProcessor(Core::IrSensor::IrCameraHandle camera_handle,
+                               ClientAppletResourceUserId aruid) {
     LOG_WARNING(Service_IRS,
                 "(STUBBED) called, npad_type={}, npad_id={}, applet_resource_user_id={}",
-                parameters.camera_handle.npad_type, parameters.camera_handle.npad_id,
-                parameters.applet_resource_user_id);
-
-    auto result = IsIrCameraHandleValid(parameters.camera_handle);
-    if (result.IsSuccess()) {
-        // TODO: Stop Image processor
-        npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
-                                    Common::Input::PollingMode::Active);
-        result = ResultSuccess;
-    }
+                camera_handle.npad_type, camera_handle.npad_id, aruid.pid);
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
-}
-
-void IRS::RunMomentProcessor(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    struct Parameters {
-        Core::IrSensor::IrCameraHandle camera_handle;
-        INSERT_PADDING_WORDS_NOINIT(1);
-        u64 applet_resource_user_id;
-        Core::IrSensor::PackedMomentProcessorConfig processor_config;
-    };
-    static_assert(sizeof(Parameters) == 0x30, "Parameters has incorrect size.");
+    R_TRY(IsIrCameraHandleValid(camera_handle));
 
-    const auto parameters{rp.PopRaw<Parameters>()};
+    // TODO: Stop Image processor
+    npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
+                                Common::Input::PollingMode::Active);
+    R_SUCCEED();
+}
 
+Result IRS::RunMomentProcessor(
+    Core::IrSensor::IrCameraHandle camera_handle, ClientAppletResourceUserId aruid,
+    const Core::IrSensor::PackedMomentProcessorConfig& processor_config) {
     LOG_WARNING(Service_IRS,
                 "(STUBBED) called, npad_type={}, npad_id={}, applet_resource_user_id={}",
-                parameters.camera_handle.npad_type, parameters.camera_handle.npad_id,
-                parameters.applet_resource_user_id);
-
-    const auto result = IsIrCameraHandleValid(parameters.camera_handle);
-
-    if (result.IsSuccess()) {
-        auto& device = GetIrCameraSharedMemoryDeviceEntry(parameters.camera_handle);
-        MakeProcessorWithCoreContext<MomentProcessor>(parameters.camera_handle, device);
-        auto& image_transfer_processor = GetProcessor<MomentProcessor>(parameters.camera_handle);
-        image_transfer_processor.SetConfig(parameters.processor_config);
-        npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
-                                    Common::Input::PollingMode::IR);
-    }
+                camera_handle.npad_type, camera_handle.npad_id, aruid.pid);
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
-}
+    R_TRY(IsIrCameraHandleValid(camera_handle));
 
-void IRS::RunClusteringProcessor(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    struct Parameters {
-        Core::IrSensor::IrCameraHandle camera_handle;
-        INSERT_PADDING_WORDS_NOINIT(1);
-        u64 applet_resource_user_id;
-        Core::IrSensor::PackedClusteringProcessorConfig processor_config;
-    };
-    static_assert(sizeof(Parameters) == 0x38, "Parameters has incorrect size.");
+    auto& device = GetIrCameraSharedMemoryDeviceEntry(camera_handle);
+    MakeProcessorWithCoreContext<MomentProcessor>(camera_handle, device);
+    auto& image_transfer_processor = GetProcessor<MomentProcessor>(camera_handle);
+    image_transfer_processor.SetConfig(processor_config);
+    npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
+                                Common::Input::PollingMode::IR);
 
-    const auto parameters{rp.PopRaw<Parameters>()};
+    R_SUCCEED();
+}
 
+Result IRS::RunClusteringProcessor(
+    Core::IrSensor::IrCameraHandle camera_handle, ClientAppletResourceUserId aruid,
+    const Core::IrSensor::PackedClusteringProcessorConfig& processor_config) {
     LOG_WARNING(Service_IRS,
                 "(STUBBED) called, npad_type={}, npad_id={}, applet_resource_user_id={}",
-                parameters.camera_handle.npad_type, parameters.camera_handle.npad_id,
-                parameters.applet_resource_user_id);
-
-    auto result = IsIrCameraHandleValid(parameters.camera_handle);
-
-    if (result.IsSuccess()) {
-        auto& device = GetIrCameraSharedMemoryDeviceEntry(parameters.camera_handle);
-        MakeProcessorWithCoreContext<ClusteringProcessor>(parameters.camera_handle, device);
-        auto& image_transfer_processor =
-            GetProcessor<ClusteringProcessor>(parameters.camera_handle);
-        image_transfer_processor.SetConfig(parameters.processor_config);
-        npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
-                                    Common::Input::PollingMode::IR);
-    }
+                camera_handle.npad_type, camera_handle.npad_id, aruid.pid);
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
-}
+    R_TRY(IsIrCameraHandleValid(camera_handle));
 
-void IRS::RunImageTransferProcessor(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    struct Parameters {
-        Core::IrSensor::IrCameraHandle camera_handle;
-        INSERT_PADDING_WORDS_NOINIT(1);
-        u64 applet_resource_user_id;
-        Core::IrSensor::PackedImageTransferProcessorConfig processor_config;
-        u32 transfer_memory_size;
-    };
-    static_assert(sizeof(Parameters) == 0x30, "Parameters has incorrect size.");
+    auto& device = GetIrCameraSharedMemoryDeviceEntry(camera_handle);
+    MakeProcessorWithCoreContext<ClusteringProcessor>(camera_handle, device);
+    auto& image_transfer_processor = GetProcessor<ClusteringProcessor>(camera_handle);
+    image_transfer_processor.SetConfig(processor_config);
+    npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
+                                Common::Input::PollingMode::IR);
 
-    const auto parameters{rp.PopRaw<Parameters>()};
-    const auto t_mem_handle{ctx.GetCopyHandle(0)};
+    R_SUCCEED();
+}
 
-    auto t_mem = ctx.GetObjectFromHandle<Kernel::KTransferMemory>(t_mem_handle);
+Result IRS::RunImageTransferProcessor(
+    Core::IrSensor::IrCameraHandle camera_handle, ClientAppletResourceUserId aruid,
+    const Core::IrSensor::PackedImageTransferProcessorConfig& processor_config,
+    u64 transfer_memory_size, InCopyHandle<Kernel::KTransferMemory> t_mem) {
 
-    if (t_mem.IsNull()) {
-        LOG_ERROR(Service_IRS, "t_mem is a nullptr for handle=0x{:08X}", t_mem_handle);
-        IPC::ResponseBuilder rb{ctx, 2};
-        rb.Push(ResultUnknown);
-        return;
-    }
-
-    ASSERT_MSG(t_mem->GetSize() == parameters.transfer_memory_size, "t_mem has incorrect size");
+    ASSERT_MSG(t_mem->GetSize() == transfer_memory_size, "t_mem has incorrect size");
 
     LOG_INFO(Service_IRS,
              "called, npad_type={}, npad_id={}, transfer_memory_size={}, transfer_memory_size={}, "
              "applet_resource_user_id={}",
-             parameters.camera_handle.npad_type, parameters.camera_handle.npad_id,
-             parameters.transfer_memory_size, t_mem->GetSize(), parameters.applet_resource_user_id);
-
-    const auto result = IsIrCameraHandleValid(parameters.camera_handle);
-
-    if (result.IsSuccess()) {
-        auto& device = GetIrCameraSharedMemoryDeviceEntry(parameters.camera_handle);
-        MakeProcessorWithCoreContext<ImageTransferProcessor>(parameters.camera_handle, device);
-        auto& image_transfer_processor =
-            GetProcessor<ImageTransferProcessor>(parameters.camera_handle);
-        image_transfer_processor.SetConfig(parameters.processor_config);
-        image_transfer_processor.SetTransferMemoryAddress(t_mem->GetSourceAddress());
-        npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
-                                    Common::Input::PollingMode::IR);
-    }
+             camera_handle.npad_type, camera_handle.npad_id, transfer_memory_size, t_mem->GetSize(),
+             aruid.pid);
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
-}
+    R_TRY(IsIrCameraHandleValid(camera_handle));
 
-void IRS::GetImageTransferProcessorState(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    struct Parameters {
-        Core::IrSensor::IrCameraHandle camera_handle;
-        INSERT_PADDING_WORDS_NOINIT(1);
-        u64 applet_resource_user_id;
-    };
-    static_assert(sizeof(Parameters) == 0x10, "Parameters has incorrect size.");
+    auto& device = GetIrCameraSharedMemoryDeviceEntry(camera_handle);
+    MakeProcessorWithCoreContext<ImageTransferProcessor>(camera_handle, device);
+    auto& image_transfer_processor = GetProcessor<ImageTransferProcessor>(camera_handle);
+    image_transfer_processor.SetConfig(processor_config);
+    image_transfer_processor.SetTransferMemoryAddress(t_mem->GetSourceAddress());
+    npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
+                                Common::Input::PollingMode::IR);
 
-    const auto parameters{rp.PopRaw<Parameters>()};
+    R_SUCCEED();
+}
 
+Result IRS::GetImageTransferProcessorState(
+    Out<Core::IrSensor::ImageTransferProcessorState> out_state,
+    Core::IrSensor::IrCameraHandle camera_handle, ClientAppletResourceUserId aruid,
+    OutBuffer<BufferAttr_HipcMapAlias> out_buffer_data) {
     LOG_DEBUG(Service_IRS, "(STUBBED) called, npad_type={}, npad_id={}, applet_resource_user_id={}",
-              parameters.camera_handle.npad_type, parameters.camera_handle.npad_id,
-              parameters.applet_resource_user_id);
-
-    const auto result = IsIrCameraHandleValid(parameters.camera_handle);
-    if (result.IsError()) {
-        IPC::ResponseBuilder rb{ctx, 2};
-        rb.Push(result);
-        return;
-    }
+              camera_handle.npad_type, camera_handle.npad_id, aruid.pid);
 
-    const auto& device = GetIrCameraSharedMemoryDeviceEntry(parameters.camera_handle);
+    R_TRY(IsIrCameraHandleValid(camera_handle));
 
-    if (device.mode != Core::IrSensor::IrSensorMode::ImageTransferProcessor) {
-        IPC::ResponseBuilder rb{ctx, 2};
-        rb.Push(InvalidProcessorState);
-        return;
-    }
+    const auto& device = GetIrCameraSharedMemoryDeviceEntry(camera_handle);
+
+    R_TRY(IsIrCameraHandleValid(camera_handle));
+    R_UNLESS(device.mode == Core::IrSensor::IrSensorMode::ImageTransferProcessor,
+             InvalidProcessorState);
 
-    std::vector<u8> data{};
-    const auto& image_transfer_processor =
-        GetProcessor<ImageTransferProcessor>(parameters.camera_handle);
-    const auto& state = image_transfer_processor.GetState(data);
+    *out_state = GetProcessor<ImageTransferProcessor>(camera_handle).GetState(out_buffer_data);
 
-    ctx.WriteBuffer(data);
-    IPC::ResponseBuilder rb{ctx, 6};
-    rb.Push(ResultSuccess);
-    rb.PushRaw(state);
+    R_SUCCEED();
 }
 
-void IRS::RunTeraPluginProcessor(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    struct Parameters {
-        Core::IrSensor::IrCameraHandle camera_handle;
-        Core::IrSensor::PackedTeraPluginProcessorConfig processor_config;
-        INSERT_PADDING_WORDS_NOINIT(1);
-        u64 applet_resource_user_id;
-    };
-    static_assert(sizeof(Parameters) == 0x18, "Parameters has incorrect size.");
+Result IRS::RunTeraPluginProcessor(Core::IrSensor::IrCameraHandle camera_handle,
+                                   Core::IrSensor::PackedTeraPluginProcessorConfig processor_config,
+                                   ClientAppletResourceUserId aruid) {
+    LOG_WARNING(Service_IRS,
+                "(STUBBED) called, npad_type={}, npad_id={}, mode={}, mcu_version={}.{}, "
+                "applet_resource_user_id={}",
+                camera_handle.npad_type, camera_handle.npad_id, processor_config.mode,
+                processor_config.required_mcu_version.major,
+                processor_config.required_mcu_version.minor, aruid.pid);
 
-    const auto parameters{rp.PopRaw<Parameters>()};
+    R_TRY(IsIrCameraHandleValid(camera_handle));
 
-    LOG_WARNING(
-        Service_IRS,
-        "(STUBBED) called, npad_type={}, npad_id={}, mode={}, mcu_version={}.{}, "
-        "applet_resource_user_id={}",
-        parameters.camera_handle.npad_type, parameters.camera_handle.npad_id,
-        parameters.processor_config.mode, parameters.processor_config.required_mcu_version.major,
-        parameters.processor_config.required_mcu_version.minor, parameters.applet_resource_user_id);
-
-    const auto result = IsIrCameraHandleValid(parameters.camera_handle);
-
-    if (result.IsSuccess()) {
-        auto& device = GetIrCameraSharedMemoryDeviceEntry(parameters.camera_handle);
-        MakeProcessor<TeraPluginProcessor>(parameters.camera_handle, device);
-        auto& image_transfer_processor =
-            GetProcessor<TeraPluginProcessor>(parameters.camera_handle);
-        image_transfer_processor.SetConfig(parameters.processor_config);
-        npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
-                                    Common::Input::PollingMode::IR);
-    }
+    auto& device = GetIrCameraSharedMemoryDeviceEntry(camera_handle);
+    MakeProcessor<TeraPluginProcessor>(camera_handle, device);
+    auto& image_transfer_processor = GetProcessor<TeraPluginProcessor>(camera_handle);
+    image_transfer_processor.SetConfig(processor_config);
+    npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
+                                Common::Input::PollingMode::IR);
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
+    R_SUCCEED();
 }
 
-void IRS::GetNpadIrCameraHandle(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    const auto npad_id{rp.PopEnum<Core::HID::NpadIdType>()};
-
-    if (npad_id > Core::HID::NpadIdType::Player8 && npad_id != Core::HID::NpadIdType::Invalid &&
-        npad_id != Core::HID::NpadIdType::Handheld) {
-        IPC::ResponseBuilder rb{ctx, 2};
-        rb.Push(Service::HID::ResultInvalidNpadId);
-        return;
-    }
+Result IRS::GetNpadIrCameraHandle(Out<Core::IrSensor::IrCameraHandle> out_camera_handle,
+                                  Core::HID::NpadIdType npad_id) {
+    R_UNLESS(HID::IsNpadIdValid(npad_id), HID::ResultInvalidNpadId);
 
-    Core::IrSensor::IrCameraHandle camera_handle{
+    *out_camera_handle = {
         .npad_id = static_cast<u8>(HID::NpadIdTypeToIndex(npad_id)),
         .npad_type = Core::HID::NpadStyleIndex::None,
     };
 
     LOG_INFO(Service_IRS, "called, npad_id={}, camera_npad_id={}, camera_npad_type={}", npad_id,
-             camera_handle.npad_id, camera_handle.npad_type);
+             out_camera_handle->npad_id, out_camera_handle->npad_type);
 
-    IPC::ResponseBuilder rb{ctx, 3};
-    rb.Push(ResultSuccess);
-    rb.PushRaw(camera_handle);
+    R_SUCCEED();
 }
 
-void IRS::RunPointingProcessor(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    const auto camera_handle{rp.PopRaw<Core::IrSensor::IrCameraHandle>()};
-    const auto processor_config{rp.PopRaw<Core::IrSensor::PackedPointingProcessorConfig>()};
-    const auto applet_resource_user_id{rp.Pop<u64>()};
-
+Result IRS::RunPointingProcessor(
+    Core::IrSensor::IrCameraHandle camera_handle,
+    const Core::IrSensor::PackedPointingProcessorConfig& processor_config,
+    ClientAppletResourceUserId aruid) {
     LOG_WARNING(
         Service_IRS,
         "(STUBBED) called, npad_type={}, npad_id={}, mcu_version={}.{}, applet_resource_user_id={}",
         camera_handle.npad_type, camera_handle.npad_id, processor_config.required_mcu_version.major,
-        processor_config.required_mcu_version.minor, applet_resource_user_id);
+        processor_config.required_mcu_version.minor, aruid.pid);
 
-    auto result = IsIrCameraHandleValid(camera_handle);
+    R_TRY(IsIrCameraHandleValid(camera_handle));
 
-    if (result.IsSuccess()) {
-        auto& device = GetIrCameraSharedMemoryDeviceEntry(camera_handle);
-        MakeProcessor<PointingProcessor>(camera_handle, device);
-        auto& image_transfer_processor = GetProcessor<PointingProcessor>(camera_handle);
-        image_transfer_processor.SetConfig(processor_config);
-        npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
-                                    Common::Input::PollingMode::IR);
-    }
+    auto& device = GetIrCameraSharedMemoryDeviceEntry(camera_handle);
+    MakeProcessor<PointingProcessor>(camera_handle, device);
+    auto& image_transfer_processor = GetProcessor<PointingProcessor>(camera_handle);
+    image_transfer_processor.SetConfig(processor_config);
+    npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
+                                Common::Input::PollingMode::IR);
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
+    R_SUCCEED();
 }
 
-void IRS::SuspendImageProcessor(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    struct Parameters {
-        Core::IrSensor::IrCameraHandle camera_handle;
-        INSERT_PADDING_WORDS_NOINIT(1);
-        u64 applet_resource_user_id;
-    };
-    static_assert(sizeof(Parameters) == 0x10, "Parameters has incorrect size.");
-
-    const auto parameters{rp.PopRaw<Parameters>()};
-
+Result IRS::SuspendImageProcessor(Core::IrSensor::IrCameraHandle camera_handle,
+                                  ClientAppletResourceUserId aruid) {
     LOG_WARNING(Service_IRS,
                 "(STUBBED) called, npad_type={}, npad_id={}, applet_resource_user_id={}",
-                parameters.camera_handle.npad_type, parameters.camera_handle.npad_id,
-                parameters.applet_resource_user_id);
+                camera_handle.npad_type, camera_handle.npad_id, aruid.pid);
 
-    auto result = IsIrCameraHandleValid(parameters.camera_handle);
-    if (result.IsSuccess()) {
-        // TODO: Suspend image processor
-        result = ResultSuccess;
-    }
+    R_TRY(IsIrCameraHandleValid(camera_handle));
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
-}
+    // TODO: Suspend image processor
 
-void IRS::CheckFirmwareVersion(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    const auto camera_handle{rp.PopRaw<Core::IrSensor::IrCameraHandle>()};
-    const auto mcu_version{rp.PopRaw<Core::IrSensor::PackedMcuVersion>()};
-    const auto applet_resource_user_id{rp.Pop<u64>()};
+    R_SUCCEED();
+}
 
+Result IRS::CheckFirmwareVersion(Core::IrSensor::IrCameraHandle camera_handle,
+                                 Core::IrSensor::PackedMcuVersion mcu_version,
+                                 ClientAppletResourceUserId aruid) {
     LOG_WARNING(
         Service_IRS,
         "(STUBBED) called, npad_type={}, npad_id={}, applet_resource_user_id={}, mcu_version={}.{}",
-        camera_handle.npad_type, camera_handle.npad_id, applet_resource_user_id, mcu_version.major,
+        camera_handle.npad_type, camera_handle.npad_id, aruid.pid, mcu_version.major,
         mcu_version.minor);
 
-    auto result = IsIrCameraHandleValid(camera_handle);
-    if (result.IsSuccess()) {
-        // TODO: Check firmware version
-        result = ResultSuccess;
-    }
+    R_TRY(IsIrCameraHandleValid(camera_handle));
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
-}
+    // TODO: Check firmware version
 
-void IRS::SetFunctionLevel(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    const auto camera_handle{rp.PopRaw<Core::IrSensor::IrCameraHandle>()};
-    const auto function_level{rp.PopRaw<Core::IrSensor::PackedFunctionLevel>()};
-    const auto applet_resource_user_id{rp.Pop<u64>()};
+    R_SUCCEED();
+}
 
+Result IRS::SetFunctionLevel(Core::IrSensor::IrCameraHandle camera_handle,
+                             Core::IrSensor::PackedFunctionLevel function_level,
+                             ClientAppletResourceUserId aruid) {
     LOG_WARNING(
         Service_IRS,
         "(STUBBED) called, npad_type={}, npad_id={}, function_level={}, applet_resource_user_id={}",
-        camera_handle.npad_type, camera_handle.npad_id, function_level.function_level,
-        applet_resource_user_id);
+        camera_handle.npad_type, camera_handle.npad_id, function_level.function_level, aruid.pid);
 
-    auto result = IsIrCameraHandleValid(camera_handle);
-    if (result.IsSuccess()) {
-        // TODO: Set Function level
-        result = ResultSuccess;
-    }
+    R_TRY(IsIrCameraHandleValid(camera_handle));
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
-}
+    // TODO: Set Function level
 
-void IRS::RunImageTransferExProcessor(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    struct Parameters {
-        Core::IrSensor::IrCameraHandle camera_handle;
-        INSERT_PADDING_WORDS_NOINIT(1);
-        u64 applet_resource_user_id;
-        Core::IrSensor::PackedImageTransferProcessorExConfig processor_config;
-        u64 transfer_memory_size;
-    };
-    static_assert(sizeof(Parameters) == 0x38, "Parameters has incorrect size.");
+    R_SUCCEED();
+}
 
-    const auto parameters{rp.PopRaw<Parameters>()};
-    const auto t_mem_handle{ctx.GetCopyHandle(0)};
+Result IRS::RunImageTransferExProcessor(
+    Core::IrSensor::IrCameraHandle camera_handle, ClientAppletResourceUserId aruid,
+    const Core::IrSensor::PackedImageTransferProcessorExConfig& processor_config,
+    u64 transfer_memory_size, InCopyHandle<Kernel::KTransferMemory> t_mem) {
 
-    auto t_mem = ctx.GetObjectFromHandle<Kernel::KTransferMemory>(t_mem_handle);
+    ASSERT_MSG(t_mem->GetSize() == transfer_memory_size, "t_mem has incorrect size");
 
     LOG_INFO(Service_IRS,
              "called, npad_type={}, npad_id={}, transfer_memory_size={}, "
              "applet_resource_user_id={}",
-             parameters.camera_handle.npad_type, parameters.camera_handle.npad_id,
-             parameters.transfer_memory_size, parameters.applet_resource_user_id);
-
-    auto result = IsIrCameraHandleValid(parameters.camera_handle);
-
-    if (result.IsSuccess()) {
-        auto& device = GetIrCameraSharedMemoryDeviceEntry(parameters.camera_handle);
-        MakeProcessorWithCoreContext<ImageTransferProcessor>(parameters.camera_handle, device);
-        auto& image_transfer_processor =
-            GetProcessor<ImageTransferProcessor>(parameters.camera_handle);
-        image_transfer_processor.SetConfig(parameters.processor_config);
-        image_transfer_processor.SetTransferMemoryAddress(t_mem->GetSourceAddress());
-        npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
-                                    Common::Input::PollingMode::IR);
-    }
+             camera_handle.npad_type, camera_handle.npad_id, transfer_memory_size, aruid.pid);
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
-}
+    R_TRY(IsIrCameraHandleValid(camera_handle));
+
+    auto& device = GetIrCameraSharedMemoryDeviceEntry(camera_handle);
+    MakeProcessorWithCoreContext<ImageTransferProcessor>(camera_handle, device);
+    auto& image_transfer_processor = GetProcessor<ImageTransferProcessor>(camera_handle);
+    image_transfer_processor.SetConfig(processor_config);
+    image_transfer_processor.SetTransferMemoryAddress(t_mem->GetSourceAddress());
+    npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
+                                Common::Input::PollingMode::IR);
 
-void IRS::RunIrLedProcessor(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    const auto camera_handle{rp.PopRaw<Core::IrSensor::IrCameraHandle>()};
-    const auto processor_config{rp.PopRaw<Core::IrSensor::PackedIrLedProcessorConfig>()};
-    const auto applet_resource_user_id{rp.Pop<u64>()};
+    R_SUCCEED();
+}
 
+Result IRS::RunIrLedProcessor(Core::IrSensor::IrCameraHandle camera_handle,
+                              Core::IrSensor::PackedIrLedProcessorConfig processor_config,
+                              ClientAppletResourceUserId aruid) {
     LOG_WARNING(Service_IRS,
                 "(STUBBED) called, npad_type={}, npad_id={}, light_target={}, mcu_version={}.{} "
                 "applet_resource_user_id={}",
                 camera_handle.npad_type, camera_handle.npad_id, processor_config.light_target,
                 processor_config.required_mcu_version.major,
-                processor_config.required_mcu_version.minor, applet_resource_user_id);
+                processor_config.required_mcu_version.minor, aruid.pid);
 
-    auto result = IsIrCameraHandleValid(camera_handle);
+    R_TRY(IsIrCameraHandleValid(camera_handle));
 
-    if (result.IsSuccess()) {
-        auto& device = GetIrCameraSharedMemoryDeviceEntry(camera_handle);
-        MakeProcessor<IrLedProcessor>(camera_handle, device);
-        auto& image_transfer_processor = GetProcessor<IrLedProcessor>(camera_handle);
-        image_transfer_processor.SetConfig(processor_config);
-        npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
-                                    Common::Input::PollingMode::IR);
-    }
+    auto& device = GetIrCameraSharedMemoryDeviceEntry(camera_handle);
+    MakeProcessor<IrLedProcessor>(camera_handle, device);
+    auto& image_transfer_processor = GetProcessor<IrLedProcessor>(camera_handle);
+    image_transfer_processor.SetConfig(processor_config);
+    npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
+                                Common::Input::PollingMode::IR);
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
+    R_SUCCEED();
 }
 
-void IRS::StopImageProcessorAsync(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    struct Parameters {
-        Core::IrSensor::IrCameraHandle camera_handle;
-        INSERT_PADDING_WORDS_NOINIT(1);
-        u64 applet_resource_user_id;
-    };
-    static_assert(sizeof(Parameters) == 0x10, "Parameters has incorrect size.");
-
-    const auto parameters{rp.PopRaw<Parameters>()};
-
+Result IRS::StopImageProcessorAsync(Core::IrSensor::IrCameraHandle camera_handle,
+                                    ClientAppletResourceUserId aruid) {
     LOG_WARNING(Service_IRS,
                 "(STUBBED) called, npad_type={}, npad_id={}, applet_resource_user_id={}",
-                parameters.camera_handle.npad_type, parameters.camera_handle.npad_id,
-                parameters.applet_resource_user_id);
-
-    auto result = IsIrCameraHandleValid(parameters.camera_handle);
-    if (result.IsSuccess()) {
-        // TODO: Stop image processor async
-        npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
-                                    Common::Input::PollingMode::Active);
-        result = ResultSuccess;
-    }
+                camera_handle.npad_type, camera_handle.npad_id, aruid.pid);
 
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(result);
-}
+    R_TRY(IsIrCameraHandleValid(camera_handle));
 
-void IRS::ActivateIrsensorWithFunctionLevel(HLERequestContext& ctx) {
-    IPC::RequestParser rp{ctx};
-    struct Parameters {
-        Core::IrSensor::PackedFunctionLevel function_level;
-        INSERT_PADDING_WORDS_NOINIT(1);
-        u64 applet_resource_user_id;
-    };
-    static_assert(sizeof(Parameters) == 0x10, "Parameters has incorrect size.");
+    // TODO: Stop image processor async
+    npad_device->SetPollingMode(Core::HID::EmulatedDeviceIndex::RightIndex,
+                                Common::Input::PollingMode::Active);
 
-    const auto parameters{rp.PopRaw<Parameters>()};
+    R_SUCCEED();
+}
 
+Result IRS::ActivateIrsensorWithFunctionLevel(Core::IrSensor::PackedFunctionLevel function_level,
+                                              ClientAppletResourceUserId aruid) {
     LOG_WARNING(Service_IRS, "(STUBBED) called, function_level={}, applet_resource_user_id={}",
-                parameters.function_level.function_level, parameters.applet_resource_user_id);
-
-    IPC::ResponseBuilder rb{ctx, 2};
-    rb.Push(ResultSuccess);
+                function_level.function_level, aruid.pid);
+    R_SUCCEED();
 }
 
 Result IRS::IsIrCameraHandleValid(const Core::IrSensor::IrCameraHandle& camera_handle) const {
diff --git a/src/core/hle/service/hid/irs.h b/src/core/hle/service/hid/irs.h
index 06b7279ee..58dfee6c3 100644
--- a/src/core/hle/service/hid/irs.h
+++ b/src/core/hle/service/hid/irs.h
@@ -4,6 +4,7 @@
 #pragma once
 
 #include "core/core.h"
+#include "core/hle/service/cmif_types.h"
 #include "core/hle/service/service.h"
 #include "hid_core/hid_types.h"
 #include "hid_core/irsensor/irs_types.h"
@@ -35,26 +36,73 @@ private:
     };
     static_assert(sizeof(StatusManager) == 0x8000, "StatusManager is an invalid size");
 
-    void ActivateIrsensor(HLERequestContext& ctx);
-    void DeactivateIrsensor(HLERequestContext& ctx);
-    void GetIrsensorSharedMemoryHandle(HLERequestContext& ctx);
-    void StopImageProcessor(HLERequestContext& ctx);
-    void RunMomentProcessor(HLERequestContext& ctx);
-    void RunClusteringProcessor(HLERequestContext& ctx);
-    void RunImageTransferProcessor(HLERequestContext& ctx);
-    void GetImageTransferProcessorState(HLERequestContext& ctx);
-    void RunTeraPluginProcessor(HLERequestContext& ctx);
-    void GetNpadIrCameraHandle(HLERequestContext& ctx);
-    void RunPointingProcessor(HLERequestContext& ctx);
-    void SuspendImageProcessor(HLERequestContext& ctx);
-    void CheckFirmwareVersion(HLERequestContext& ctx);
-    void SetFunctionLevel(HLERequestContext& ctx);
-    void RunImageTransferExProcessor(HLERequestContext& ctx);
-    void RunIrLedProcessor(HLERequestContext& ctx);
-    void StopImageProcessorAsync(HLERequestContext& ctx);
-    void ActivateIrsensorWithFunctionLevel(HLERequestContext& ctx);
+    Result ActivateIrsensor(ClientAppletResourceUserId aruid);
+
+    Result DeactivateIrsensor(ClientAppletResourceUserId aruid);
+
+    Result GetIrsensorSharedMemoryHandle(OutCopyHandle<Kernel::KSharedMemory> out_shared_memory,
+                                         ClientAppletResourceUserId aruid);
+    Result StopImageProcessor(Core::IrSensor::IrCameraHandle camera_handle,
+                              ClientAppletResourceUserId aruid);
+
+    Result RunMomentProcessor(Core::IrSensor::IrCameraHandle camera_handle,
+                              ClientAppletResourceUserId aruid,
+                              const Core::IrSensor::PackedMomentProcessorConfig& processor_config);
+
+    Result RunClusteringProcessor(
+        Core::IrSensor::IrCameraHandle camera_handle, ClientAppletResourceUserId aruid,
+        const Core::IrSensor::PackedClusteringProcessorConfig& processor_config);
+
+    Result RunImageTransferProcessor(
+        Core::IrSensor::IrCameraHandle camera_handle, ClientAppletResourceUserId aruid,
+        const Core::IrSensor::PackedImageTransferProcessorConfig& processor_config,
+        u64 transfer_memory_size, InCopyHandle<Kernel::KTransferMemory> t_mem);
+
+    Result GetImageTransferProcessorState(
+        Out<Core::IrSensor::ImageTransferProcessorState> out_state,
+        Core::IrSensor::IrCameraHandle camera_handle, ClientAppletResourceUserId aruid,
+        OutBuffer<BufferAttr_HipcMapAlias> out_buffer_data);
+
+    Result RunTeraPluginProcessor(Core::IrSensor::IrCameraHandle camera_handle,
+                                  Core::IrSensor::PackedTeraPluginProcessorConfig processor_config,
+                                  ClientAppletResourceUserId aruid);
+
+    Result GetNpadIrCameraHandle(Out<Core::IrSensor::IrCameraHandle> out_camera_handle,
+                                 Core::HID::NpadIdType npad_id);
+
+    Result RunPointingProcessor(
+        Core::IrSensor::IrCameraHandle camera_handle,
+        const Core::IrSensor::PackedPointingProcessorConfig& processor_config,
+        ClientAppletResourceUserId aruid);
+
+    Result SuspendImageProcessor(Core::IrSensor::IrCameraHandle camera_handle,
+                                 ClientAppletResourceUserId aruid);
+
+    Result CheckFirmwareVersion(Core::IrSensor::IrCameraHandle camera_handle,
+                                Core::IrSensor::PackedMcuVersion mcu_version,
+                                ClientAppletResourceUserId aruid);
+
+    Result SetFunctionLevel(Core::IrSensor::IrCameraHandle camera_handle,
+                            Core::IrSensor::PackedFunctionLevel function_level,
+                            ClientAppletResourceUserId aruid);
+
+    Result RunImageTransferExProcessor(
+        Core::IrSensor::IrCameraHandle camera_handle, ClientAppletResourceUserId aruid,
+        const Core::IrSensor::PackedImageTransferProcessorExConfig& processor_config,
+        u64 transfer_memory_size, InCopyHandle<Kernel::KTransferMemory> t_mem);
+
+    Result RunIrLedProcessor(Core::IrSensor::IrCameraHandle camera_handle,
+                             Core::IrSensor::PackedIrLedProcessorConfig processor_config,
+                             ClientAppletResourceUserId aruid);
+
+    Result StopImageProcessorAsync(Core::IrSensor::IrCameraHandle camera_handle,
+                                   ClientAppletResourceUserId aruid);
+
+    Result ActivateIrsensorWithFunctionLevel(Core::IrSensor::PackedFunctionLevel function_level,
+                                             ClientAppletResourceUserId aruid);
 
     Result IsIrCameraHandleValid(const Core::IrSensor::IrCameraHandle& camera_handle) const;
+
     Core::IrSensor::DeviceFormat& GetIrCameraSharedMemoryDeviceEntry(
         const Core::IrSensor::IrCameraHandle& camera_handle);
 
diff --git a/src/core/hle/service/nvdrv/devices/nvhost_as_gpu.cpp b/src/core/hle/service/nvdrv/devices/nvhost_as_gpu.cpp
index e6646ba04..68fe38874 100644
--- a/src/core/hle/service/nvdrv/devices/nvhost_as_gpu.cpp
+++ b/src/core/hle/service/nvdrv/devices/nvhost_as_gpu.cpp
@@ -123,6 +123,8 @@ NvResult nvhost_as_gpu::AllocAsEx(IoctlAllocAsEx& params) {
         vm.va_range_end = params.va_range_end;
     }
 
+    const u64 max_big_page_bits = Common::Log2Ceil64(vm.va_range_end);
+
     const auto start_pages{static_cast<u32>(vm.va_range_start >> VM::PAGE_SIZE_BITS)};
     const auto end_pages{static_cast<u32>(vm.va_range_split >> VM::PAGE_SIZE_BITS)};
     vm.small_page_allocator = std::make_shared<VM::Allocator>(start_pages, end_pages);
@@ -132,8 +134,8 @@ NvResult nvhost_as_gpu::AllocAsEx(IoctlAllocAsEx& params) {
         static_cast<u32>((vm.va_range_end - vm.va_range_split) >> vm.big_page_size_bits)};
     vm.big_page_allocator = std::make_unique<VM::Allocator>(start_big_pages, end_big_pages);
 
-    gmmu = std::make_shared<Tegra::MemoryManager>(system, 40, vm.big_page_size_bits,
-                                                  VM::PAGE_SIZE_BITS);
+    gmmu = std::make_shared<Tegra::MemoryManager>(system, max_big_page_bits, vm.va_range_split,
+                                                  vm.big_page_size_bits, VM::PAGE_SIZE_BITS);
     system.GPU().InitAddressSpace(*gmmu);
     vm.initialised = true;
 
diff --git a/src/core/hle/service/nvnflinger/hardware_composer.cpp b/src/core/hle/service/nvnflinger/hardware_composer.cpp
index c720dd1f8..ba2b5c28c 100644
--- a/src/core/hle/service/nvnflinger/hardware_composer.cpp
+++ b/src/core/hle/service/nvnflinger/hardware_composer.cpp
@@ -7,7 +7,6 @@
 #include "core/hle/service/nvdrv/devices/nvdisp_disp0.h"
 #include "core/hle/service/nvnflinger/buffer_item.h"
 #include "core/hle/service/nvnflinger/buffer_item_consumer.h"
-#include "core/hle/service/nvnflinger/buffer_queue_producer.h"
 #include "core/hle/service/nvnflinger/hardware_composer.h"
 #include "core/hle/service/nvnflinger/hwc_layer.h"
 #include "core/hle/service/nvnflinger/ui/graphic_buffer.h"
@@ -46,31 +45,9 @@ HardwareComposer::HardwareComposer() = default;
 HardwareComposer::~HardwareComposer() = default;
 
 u32 HardwareComposer::ComposeLocked(f32* out_speed_scale, VI::Display& display,
-                                    Nvidia::Devices::nvdisp_disp0& nvdisp, u32 frame_advance) {
+                                    Nvidia::Devices::nvdisp_disp0& nvdisp) {
     boost::container::small_vector<HwcLayer, 2> composition_stack;
 
-    m_frame_number += frame_advance;
-
-    // Release any necessary framebuffers.
-    for (auto& [layer_id, framebuffer] : m_framebuffers) {
-        if (framebuffer.release_frame_number > m_frame_number) {
-            // Not yet ready to release this framebuffer.
-            continue;
-        }
-
-        if (!framebuffer.is_acquired) {
-            // Already released.
-            continue;
-        }
-
-        if (auto* layer = display.FindLayer(layer_id); layer != nullptr) {
-            // TODO: support release fence
-            // This is needed to prevent screen tearing
-            layer->GetConsumer().ReleaseBuffer(framebuffer.item, android::Fence::NoFence());
-            framebuffer.is_acquired = false;
-        }
-    }
-
     // Set default speed limit to 100%.
     *out_speed_scale = 1.0f;
 
@@ -142,7 +119,30 @@ u32 HardwareComposer::ComposeLocked(f32* out_speed_scale, VI::Display& display,
     MicroProfileFlip();
 
     // Advance by at least one frame.
-    return swap_interval.value_or(1);
+    const u32 frame_advance = swap_interval.value_or(1);
+    m_frame_number += frame_advance;
+
+    // Release any necessary framebuffers.
+    for (auto& [layer_id, framebuffer] : m_framebuffers) {
+        if (framebuffer.release_frame_number > m_frame_number) {
+            // Not yet ready to release this framebuffer.
+            continue;
+        }
+
+        if (!framebuffer.is_acquired) {
+            // Already released.
+            continue;
+        }
+
+        if (auto* layer = display.FindLayer(layer_id); layer != nullptr) {
+            // TODO: support release fence
+            // This is needed to prevent screen tearing
+            layer->GetConsumer().ReleaseBuffer(framebuffer.item, android::Fence::NoFence());
+            framebuffer.is_acquired = false;
+        }
+    }
+
+    return frame_advance;
 }
 
 void HardwareComposer::RemoveLayerLocked(VI::Display& display, LayerId layer_id) {
diff --git a/src/core/hle/service/nvnflinger/hardware_composer.h b/src/core/hle/service/nvnflinger/hardware_composer.h
index ddab94ac9..28392c512 100644
--- a/src/core/hle/service/nvnflinger/hardware_composer.h
+++ b/src/core/hle/service/nvnflinger/hardware_composer.h
@@ -27,7 +27,7 @@ public:
     ~HardwareComposer();
 
     u32 ComposeLocked(f32* out_speed_scale, VI::Display& display,
-                      Nvidia::Devices::nvdisp_disp0& nvdisp, u32 frame_advance);
+                      Nvidia::Devices::nvdisp_disp0& nvdisp);
     void RemoveLayerLocked(VI::Display& display, LayerId layer_id);
 
 private:
diff --git a/src/core/hle/service/nvnflinger/nvnflinger.cpp b/src/core/hle/service/nvnflinger/nvnflinger.cpp
index a4e848882..d8ba89d43 100644
--- a/src/core/hle/service/nvnflinger/nvnflinger.cpp
+++ b/src/core/hle/service/nvnflinger/nvnflinger.cpp
@@ -291,8 +291,7 @@ void Nvnflinger::Compose() {
         auto nvdisp = nvdrv->GetDevice<Nvidia::Devices::nvdisp_disp0>(disp_fd);
         ASSERT(nvdisp);
 
-        swap_interval = display.GetComposer().ComposeLocked(&compose_speed_scale, display, *nvdisp,
-                                                            swap_interval);
+        swap_interval = display.GetComposer().ComposeLocked(&compose_speed_scale, display, *nvdisp);
     }
 }
 
diff --git a/src/core/memory/cheat_engine.cpp b/src/core/memory/cheat_engine.cpp
index 96fa7fa3a..14d1a3840 100644
--- a/src/core/memory/cheat_engine.cpp
+++ b/src/core/memory/cheat_engine.cpp
@@ -9,6 +9,7 @@
 #include "core/core_timing.h"
 #include "core/hle/kernel/k_page_table.h"
 #include "core/hle/kernel/k_process.h"
+#include "core/hle/kernel/k_process_page_table.h"
 #include "core/hle/service/hid/hid_server.h"
 #include "core/hle/service/sm/sm.h"
 #include "core/memory.h"
@@ -46,12 +47,23 @@ StandardVmCallbacks::StandardVmCallbacks(System& system_, const CheatProcessMeta
 
 StandardVmCallbacks::~StandardVmCallbacks() = default;
 
-void StandardVmCallbacks::MemoryRead(VAddr address, void* data, u64 size) {
-    system.ApplicationMemory().ReadBlock(SanitizeAddress(address), data, size);
+void StandardVmCallbacks::MemoryReadUnsafe(VAddr address, void* data, u64 size) {
+    // Return zero on invalid address
+    if (!IsAddressInRange(address) || !system.ApplicationMemory().IsValidVirtualAddress(address)) {
+        std::memset(data, 0, size);
+        return;
+    }
+
+    system.ApplicationMemory().ReadBlock(address, data, size);
 }
 
-void StandardVmCallbacks::MemoryWrite(VAddr address, const void* data, u64 size) {
-    system.ApplicationMemory().WriteBlock(SanitizeAddress(address), data, size);
+void StandardVmCallbacks::MemoryWriteUnsafe(VAddr address, const void* data, u64 size) {
+    // Skip invalid memory write address
+    if (!IsAddressInRange(address) || !system.ApplicationMemory().IsValidVirtualAddress(address)) {
+        return;
+    }
+
+    system.ApplicationMemory().WriteBlock(address, data, size);
 }
 
 u64 StandardVmCallbacks::HidKeysDown() {
@@ -81,21 +93,25 @@ void StandardVmCallbacks::CommandLog(std::string_view data) {
               data.back() == '\n' ? data.substr(0, data.size() - 1) : data);
 }
 
-VAddr StandardVmCallbacks::SanitizeAddress(VAddr in) const {
+bool StandardVmCallbacks::IsAddressInRange(VAddr in) const {
     if ((in < metadata.main_nso_extents.base ||
          in >= metadata.main_nso_extents.base + metadata.main_nso_extents.size) &&
         (in < metadata.heap_extents.base ||
-         in >= metadata.heap_extents.base + metadata.heap_extents.size)) {
-        LOG_ERROR(CheatEngine,
+         in >= metadata.heap_extents.base + metadata.heap_extents.size) &&
+        (in < metadata.alias_extents.base ||
+         in >= metadata.heap_extents.base + metadata.alias_extents.size) &&
+        (in < metadata.aslr_extents.base ||
+         in >= metadata.heap_extents.base + metadata.aslr_extents.size)) {
+        LOG_DEBUG(CheatEngine,
                   "Cheat attempting to access memory at invalid address={:016X}, if this "
                   "persists, "
                   "the cheat may be incorrect. However, this may be normal early in execution if "
                   "the game has not properly set up yet.",
                   in);
-        return 0; ///< Invalid addresses will hard crash
+        return false; ///< Invalid addresses will hard crash
     }
 
-    return in;
+    return true;
 }
 
 CheatParser::~CheatParser() = default;
@@ -211,16 +227,14 @@ void CheatEngine::Initialize() {
         .base = GetInteger(page_table.GetHeapRegionStart()),
         .size = page_table.GetHeapRegionSize(),
     };
-
-    metadata.address_space_extents = {
-        .base = GetInteger(page_table.GetAddressSpaceStart()),
-        .size = page_table.GetAddressSpaceSize(),
-    };
-
-    metadata.alias_extents = {
+    metadata.aslr_extents = {
         .base = GetInteger(page_table.GetAliasCodeRegionStart()),
         .size = page_table.GetAliasCodeRegionSize(),
     };
+    metadata.alias_extents = {
+        .base = GetInteger(page_table.GetAliasRegionStart()),
+        .size = page_table.GetAliasRegionSize(),
+    };
 
     is_pending_reload.exchange(true);
 }
diff --git a/src/core/memory/cheat_engine.h b/src/core/memory/cheat_engine.h
index ced2168d1..619cabaa2 100644
--- a/src/core/memory/cheat_engine.h
+++ b/src/core/memory/cheat_engine.h
@@ -27,17 +27,17 @@ public:
     StandardVmCallbacks(System& system_, const CheatProcessMetadata& metadata_);
     ~StandardVmCallbacks() override;
 
-    void MemoryRead(VAddr address, void* data, u64 size) override;
-    void MemoryWrite(VAddr address, const void* data, u64 size) override;
+    void MemoryReadUnsafe(VAddr address, void* data, u64 size) override;
+    void MemoryWriteUnsafe(VAddr address, const void* data, u64 size) override;
     u64 HidKeysDown() override;
     void DebugLog(u8 id, u64 value) override;
     void CommandLog(std::string_view data) override;
 
 private:
-    VAddr SanitizeAddress(VAddr address) const;
+    bool IsAddressInRange(VAddr address) const;
 
     const CheatProcessMetadata& metadata;
-    System& system;
+    Core::System& system;
 };
 
 // Intermediary class that parses a text file or other disk format for storing cheats into a
diff --git a/src/core/memory/dmnt_cheat_types.h b/src/core/memory/dmnt_cheat_types.h
index c6b40e505..64c072d3d 100644
--- a/src/core/memory/dmnt_cheat_types.h
+++ b/src/core/memory/dmnt_cheat_types.h
@@ -18,7 +18,7 @@ struct CheatProcessMetadata {
     MemoryRegionExtents main_nso_extents{};
     MemoryRegionExtents heap_extents{};
     MemoryRegionExtents alias_extents{};
-    MemoryRegionExtents address_space_extents{};
+    MemoryRegionExtents aslr_extents{};
     std::array<u8, 0x20> main_nso_build_id{};
 };
 
diff --git a/src/core/memory/dmnt_cheat_vm.cpp b/src/core/memory/dmnt_cheat_vm.cpp
index 31ffc4fbb..8bc81e72d 100644
--- a/src/core/memory/dmnt_cheat_vm.cpp
+++ b/src/core/memory/dmnt_cheat_vm.cpp
@@ -322,8 +322,9 @@ bool DmntCheatVm::DecodeNextOpcode(CheatVmOpcode& out) {
     } break;
     case CheatVmOpcodeType::EndConditionalBlock: {
         // 20000000
-        // There's actually nothing left to process here!
-        opcode.opcode = EndConditionalOpcode{};
+        opcode.opcode = EndConditionalOpcode{
+            .is_else = ((first_dword >> 24) & 0xf) == 1,
+        };
     } break;
     case CheatVmOpcodeType::ControlLoop: {
         // 300R0000 VVVVVVVV
@@ -555,6 +556,18 @@ bool DmntCheatVm::DecodeNextOpcode(CheatVmOpcode& out) {
             .idx = first_dword & 0xF,
         };
     } break;
+    case CheatVmOpcodeType::PauseProcess: {
+        /* FF0????? */
+        /* FF0 = opcode 0xFF0 */
+        /* Pauses the current process. */
+        opcode.opcode = PauseProcessOpcode{};
+    } break;
+    case CheatVmOpcodeType::ResumeProcess: {
+        /* FF0????? */
+        /* FF0 = opcode 0xFF0 */
+        /* Pauses the current process. */
+        opcode.opcode = ResumeProcessOpcode{};
+    } break;
     case CheatVmOpcodeType::DebugLog: {
         // FFFTIX##
         // FFFTI0Ma aaaaaaaa
@@ -621,7 +634,7 @@ bool DmntCheatVm::DecodeNextOpcode(CheatVmOpcode& out) {
     return valid;
 }
 
-void DmntCheatVm::SkipConditionalBlock() {
+void DmntCheatVm::SkipConditionalBlock(bool is_if) {
     if (condition_depth > 0) {
         // We want to continue until we're out of the current block.
         const std::size_t desired_depth = condition_depth - 1;
@@ -637,8 +650,12 @@ void DmntCheatVm::SkipConditionalBlock() {
             // We also support nesting of conditional blocks, and Gateway does not.
             if (skip_opcode.begin_conditional_block) {
                 condition_depth++;
-            } else if (std::holds_alternative<EndConditionalOpcode>(skip_opcode.opcode)) {
-                condition_depth--;
+            } else if (auto end_cond = std::get_if<EndConditionalOpcode>(&skip_opcode.opcode)) {
+                if (!end_cond->is_else) {
+                    condition_depth--;
+                } else if (is_if && condition_depth - 1 == desired_depth) {
+                    break;
+                }
             }
         }
     } else {
@@ -675,6 +692,10 @@ u64 DmntCheatVm::GetCheatProcessAddress(const CheatProcessMetadata& metadata,
         return metadata.main_nso_extents.base + rel_address;
     case MemoryAccessType::Heap:
         return metadata.heap_extents.base + rel_address;
+    case MemoryAccessType::Alias:
+        return metadata.alias_extents.base + rel_address;
+    case MemoryAccessType::Aslr:
+        return metadata.aslr_extents.base + rel_address;
     }
 }
 
@@ -682,7 +703,6 @@ void DmntCheatVm::ResetState() {
     registers.fill(0);
     saved_values.fill(0);
     loop_tops.fill(0);
-    static_registers.fill(0);
     instruction_ptr = 0;
     condition_depth = 0;
     decode_success = true;
@@ -753,7 +773,7 @@ void DmntCheatVm::Execute(const CheatProcessMetadata& metadata) {
             case 2:
             case 4:
             case 8:
-                callbacks->MemoryWrite(dst_address, &dst_value, store_static->bit_width);
+                callbacks->MemoryWriteUnsafe(dst_address, &dst_value, store_static->bit_width);
                 break;
             }
         } else if (auto begin_cond = std::get_if<BeginConditionalOpcode>(&cur_opcode.opcode)) {
@@ -766,7 +786,7 @@ void DmntCheatVm::Execute(const CheatProcessMetadata& metadata) {
             case 2:
             case 4:
             case 8:
-                callbacks->MemoryRead(src_address, &src_value, begin_cond->bit_width);
+                callbacks->MemoryReadUnsafe(src_address, &src_value, begin_cond->bit_width);
                 break;
             }
             // Check against condition.
@@ -794,13 +814,18 @@ void DmntCheatVm::Execute(const CheatProcessMetadata& metadata) {
             }
             // Skip conditional block if condition not met.
             if (!cond_met) {
-                SkipConditionalBlock();
+                SkipConditionalBlock(true);
             }
-        } else if (std::holds_alternative<EndConditionalOpcode>(cur_opcode.opcode)) {
-            // Decrement the condition depth.
-            // We will assume, graciously, that mismatched conditional block ends are a nop.
-            if (condition_depth > 0) {
-                condition_depth--;
+        } else if (auto end_cond = std::get_if<EndConditionalOpcode>(&cur_opcode.opcode)) {
+            if (end_cond->is_else) {
+                /* Skip to the end of the conditional block. */
+                this->SkipConditionalBlock(false);
+            } else {
+                /* Decrement the condition depth. */
+                /* We will assume, graciously, that mismatched conditional block ends are a nop. */
+                if (condition_depth > 0) {
+                    condition_depth--;
+                }
             }
         } else if (auto ctrl_loop = std::get_if<ControlLoopOpcode>(&cur_opcode.opcode)) {
             if (ctrl_loop->start_loop) {
@@ -832,8 +857,8 @@ void DmntCheatVm::Execute(const CheatProcessMetadata& metadata) {
             case 2:
             case 4:
             case 8:
-                callbacks->MemoryRead(src_address, &registers[ldr_memory->reg_index],
-                                      ldr_memory->bit_width);
+                callbacks->MemoryReadUnsafe(src_address, &registers[ldr_memory->reg_index],
+                                            ldr_memory->bit_width);
                 break;
             }
         } else if (auto str_static = std::get_if<StoreStaticToAddressOpcode>(&cur_opcode.opcode)) {
@@ -849,7 +874,7 @@ void DmntCheatVm::Execute(const CheatProcessMetadata& metadata) {
             case 2:
             case 4:
             case 8:
-                callbacks->MemoryWrite(dst_address, &dst_value, str_static->bit_width);
+                callbacks->MemoryWriteUnsafe(dst_address, &dst_value, str_static->bit_width);
                 break;
             }
             // Increment register if relevant.
@@ -908,7 +933,7 @@ void DmntCheatVm::Execute(const CheatProcessMetadata& metadata) {
             // Check for keypress.
             if ((begin_keypress_cond->key_mask & kDown) != begin_keypress_cond->key_mask) {
                 // Keys not pressed. Skip conditional block.
-                SkipConditionalBlock();
+                SkipConditionalBlock(true);
             }
         } else if (auto perform_math_reg =
                        std::get_if<PerformArithmeticRegisterOpcode>(&cur_opcode.opcode)) {
@@ -1007,7 +1032,7 @@ void DmntCheatVm::Execute(const CheatProcessMetadata& metadata) {
             case 2:
             case 4:
             case 8:
-                callbacks->MemoryWrite(dst_address, &dst_value, str_register->bit_width);
+                callbacks->MemoryWriteUnsafe(dst_address, &dst_value, str_register->bit_width);
                 break;
             }
 
@@ -1086,7 +1111,8 @@ void DmntCheatVm::Execute(const CheatProcessMetadata& metadata) {
                 case 2:
                 case 4:
                 case 8:
-                    callbacks->MemoryRead(cond_address, &cond_value, begin_reg_cond->bit_width);
+                    callbacks->MemoryReadUnsafe(cond_address, &cond_value,
+                                                begin_reg_cond->bit_width);
                     break;
                 }
             }
@@ -1116,7 +1142,7 @@ void DmntCheatVm::Execute(const CheatProcessMetadata& metadata) {
 
             // Skip conditional block if condition not met.
             if (!cond_met) {
-                SkipConditionalBlock();
+                SkipConditionalBlock(true);
             }
         } else if (auto save_restore_reg =
                        std::get_if<SaveRestoreRegisterOpcode>(&cur_opcode.opcode)) {
@@ -1178,6 +1204,10 @@ void DmntCheatVm::Execute(const CheatProcessMetadata& metadata) {
                 // Store a register to a static register.
                 static_registers[rw_static_reg->static_idx] = registers[rw_static_reg->idx];
             }
+        } else if (std::holds_alternative<PauseProcessOpcode>(cur_opcode.opcode)) {
+            // TODO: Pause cheat process
+        } else if (std::holds_alternative<ResumeProcessOpcode>(cur_opcode.opcode)) {
+            // TODO: Resume cheat process
         } else if (auto debug_log = std::get_if<DebugLogOpcode>(&cur_opcode.opcode)) {
             // Read value from memory.
             u64 log_value = 0;
@@ -1224,7 +1254,7 @@ void DmntCheatVm::Execute(const CheatProcessMetadata& metadata) {
                 case 2:
                 case 4:
                 case 8:
-                    callbacks->MemoryRead(val_address, &log_value, debug_log->bit_width);
+                    callbacks->MemoryReadUnsafe(val_address, &log_value, debug_log->bit_width);
                     break;
                 }
             }
diff --git a/src/core/memory/dmnt_cheat_vm.h b/src/core/memory/dmnt_cheat_vm.h
index 641cb09c4..fed6a24ad 100644
--- a/src/core/memory/dmnt_cheat_vm.h
+++ b/src/core/memory/dmnt_cheat_vm.h
@@ -42,12 +42,16 @@ enum class CheatVmOpcodeType : u32 {
     DoubleExtendedWidth = 0xF0,
 
     // Double-extended width opcodes.
+    PauseProcess = 0xFF0,
+    ResumeProcess = 0xFF1,
     DebugLog = 0xFFF,
 };
 
 enum class MemoryAccessType : u32 {
     MainNso = 0,
     Heap = 1,
+    Alias = 2,
+    Aslr = 3,
 };
 
 enum class ConditionalComparisonType : u32 {
@@ -131,7 +135,9 @@ struct BeginConditionalOpcode {
     VmInt value{};
 };
 
-struct EndConditionalOpcode {};
+struct EndConditionalOpcode {
+    bool is_else;
+};
 
 struct ControlLoopOpcode {
     bool start_loop{};
@@ -222,6 +228,10 @@ struct ReadWriteStaticRegisterOpcode {
     u32 idx{};
 };
 
+struct PauseProcessOpcode {};
+
+struct ResumeProcessOpcode {};
+
 struct DebugLogOpcode {
     u32 bit_width{};
     u32 log_id{};
@@ -244,8 +254,8 @@ struct CheatVmOpcode {
                  PerformArithmeticStaticOpcode, BeginKeypressConditionalOpcode,
                  PerformArithmeticRegisterOpcode, StoreRegisterToAddressOpcode,
                  BeginRegisterConditionalOpcode, SaveRestoreRegisterOpcode,
-                 SaveRestoreRegisterMaskOpcode, ReadWriteStaticRegisterOpcode, DebugLogOpcode,
-                 UnrecognizedInstruction>
+                 SaveRestoreRegisterMaskOpcode, ReadWriteStaticRegisterOpcode, PauseProcessOpcode,
+                 ResumeProcessOpcode, DebugLogOpcode, UnrecognizedInstruction>
         opcode{};
 };
 
@@ -256,8 +266,8 @@ public:
     public:
         virtual ~Callbacks();
 
-        virtual void MemoryRead(VAddr address, void* data, u64 size) = 0;
-        virtual void MemoryWrite(VAddr address, const void* data, u64 size) = 0;
+        virtual void MemoryReadUnsafe(VAddr address, void* data, u64 size) = 0;
+        virtual void MemoryWriteUnsafe(VAddr address, const void* data, u64 size) = 0;
 
         virtual u64 HidKeysDown() = 0;
 
@@ -296,7 +306,7 @@ private:
     std::array<std::size_t, NumRegisters> loop_tops{};
 
     bool DecodeNextOpcode(CheatVmOpcode& out);
-    void SkipConditionalBlock();
+    void SkipConditionalBlock(bool is_if);
     void ResetState();
 
     // For implementing the DebugLog opcode.