Hollow Knight: Silksong (PPSA12544)

[merwie]

Tested

• Title: Hollow Knight: Silksong, PPSA12544, content version 01.000.010 (master 01.02, SDK 0x11000000). Unity, IL2CPP, FMOD.
• Host: Windows 11 Pro, AMD Ryzen 7 9800X3D, Radeon RX 9070 XT. Relinked with --windows --module-dir Media/Plugins (no --to-intel). Built with WinLibs GCC 15.2.0 r7.
• Dump: fake-signed SELFs (eboot.bin, sce_module/*.prx, Media/Modules/*.prx, Media/Plugins/*.prx), unwrapped to plain ELF before relinking.
• Last update: 2026-10-08

Status

Playable at 60 fps. On the stack below, the game boots. Menus, audio (no crackle) and keyboard input work. The intro cinematic plays, a new game reaches gameplay, and room transitions work.

• Dark layer stuck after room changes: fixed by fix(agc): store uncompressed DCC keys at the first write of a fast-cleared image #903. Draws into a fast-cleared render target left its DCC keys at the clear code, so the title's next fast clear with the same code went unseen. Analysis in agc-driver: storage image write-back drops GPU results for CPU-stamped 64 KiB edge blocks (boxes in Silksong's menu text) #865.
• Boxed menu glyphs: still open, cause found (agc-driver: storage image write-back drops GPU results for CPU-stamped 64 KiB edge blocks (boxes in Silksong's menu text) #865). CPU stamps on the unaligned glyph atlas's edge pages don't change any bytes, but the write-back keeps those edge blocks for the CPU and drops the GPU's glyphs. A byte-wise merge fixes it locally at 60 fps. An edge-only merge is proposed in agc-driver: storage image write-back drops GPU results for CPU-stamped 64 KiB edge blocks (boxes in Silksong's menu text) #865. Worked around locally with eager write-back of the glyph images.
• Unity TLSF allocator crash (heap corruption while assets stream): seen about 4 times in a dozen runs on 2026-10-06, not seen in about 20 runs on 2026-10-08. Cause not found.

Correction (2026-10-06): an earlier version of this post, and a comment on #648, said the output looked correct. I had not checked it: every presented frame was black. The cause was draws skipped for PA_SC_MODE_CNTL_1 bit 17 (#840).

Still needed beyond main

	For
#846	DllNotFoundException: Unable to load DLL 'PSN': plugins in Media/Plugins are loaded at run time with start arguments	open
#425	first scene: sampling the stencil/depth plane of a depth surface	open
#407 (two functions)	plugin imports	open; local stand-ins
Blocker A	VideoOut: display buffer ... reads mixed DCC keys ... at the first flip: the non-uncompressed keys lie in the padding rows past 1080 (data in #648). My build still classifies only the visible part of the keys. Not rechecked on current main.	local workaround
#865	boxed menu glyphs	local workaround

Stops, in the order they were hit

All merged unless marked.

Stop	Covered by
Unsupported special symbol section in Il2cppUserAssemblies.prx (151 SHN_ABS marker symbols)	#698
Failed to load module ... libs\Il2cppUserAssemblies.prx (needed modules in Media/Modules, outside sce_module)	#716
Unresolved imports (Font, Http2, Net, Pad, Ssl, SystemService, UserService, libkernel, POSIX)	#699
Unresolved imports: sceKernelSyncOnAddressWait32/64	#633
Unresolved imports: dbOlWdppb4o (libSceAgc)	#651
Unresolved imports: the three libSceLibcInternalExt thread-exit functions	#641
Unresolved imports: sceVideoOutVrrPegToFixedRate, sceVideoOutVrrUnpegFromFixedRate	#518
Access violation in the first allocator commit: sceKernelVirtualQuery returns EACCES inside a reserved range	#700
NH6xARDOVv8 not implemented (sceKernelGetOperationMode)	#699
sceUserServiceGetAgeLevel not implemented	#705
sceKernelIsStack not implemented	#702
validateOutputConfig: VIDEO_OUT_ERROR_UNSUPPORTED_OUTPUT_MODE (probe of 0xd000000a), then sceVideoOutConfigureOutput throwing instead of returning UNAVAILABLE_OUTPUT_MODE	#709
expected JSON object in param.json (defaultLanguage inside localizedParameters, only en-GB)	#710
VideoOut: DCC presentation is not implemented	#648, #647
sceKernelCheckedReleaseDirectMemory not implemented	#721
Null il2cpp_set_find_plugin_callback: sceKernelLoadStartModule("/app0/Media/Modules/Il2CppUserAssemblies.prx") returned 0x80020002	#717
sceKernelInstallExceptionHandler not implemented	#724
sceKernelRaiseException not implemented (Unity's GC stops threads with SIGUSR1; targets blocked in libkernel waits)	#760 (Windows), design in #727
Divide by zero in managed code after the first GC: the main thread's stack was reported as null/0, so the GC freed live objects	#761
DllNotFoundException: Unable to load DLL 'PSN' (native plugins in Media/Plugins, loaded at run time)	#846 (open)
Failed to load module ... libSceVrSetupDialog.prx and other plugin imports	#763, #734, #369; two functions of #407 (open)
unresolved ELF import wTpfglkmv34 (sceMsgDialogProgressBar* from libSceMsgDialog.native)	#762
SaveDataException (0x809F0005): the executable and the SaveData plugin both call sceSaveDataInitialize3	#841
sceImeKeyboardGetResourceId not implemented	#696
sceAppContentDownloadDataGetAvailableSpaceKb: the title declares no download data	#842
compute shader ...: AGC graphics: unsupported descriptor role Gds	#285
sceAgcDriverGetEqContextId not implemented	#844
Blocker A (see above)	#648; not rechecked on current main
All presented frames black: skipped draw: sample iteration, primitive discard or out-of-order rasterization is unsupported (register 0x293 = 0x06020000)	#840
Intro cinematic stays black: a paused AvPlayer delivered no frame after JumpToTime	#893
Crash after the cinematic: sceKernelGetModuleInfoForUnwind reported no eh_frame_hdr on Windows, so the title's own libc could not unwind any C++ (IL2CPP) exception	#904
Crash in exception delivery: a thread redirected inside a system call resumes through sysret, which overwrites rcx	#760
First scene: sampling the stencil/depth plane of depth surface ... is not implemented	#425 (open)
Audio crackle: AudioOut2 read each grain at push time, while FMOD fills the buffer after pushing it, and reported an empty queue	#839
Dark foreground layer stuck after a room transition	#903 (#865)
Some menu letters render as solid boxes	#865 (open)

Notes

• PS5Util (Unity) and exception handlers: gc_stop_init installs a SIGUSR1 handler that reads uc_mcontext.mc_rsp (offset 0xf8 of the PS5 ucontext) and raises SIGUSR1 on each thread to stop it for collection. Design: Exception handler delivery (sceKernelRaiseException, fault handlers) #727.
• Media/Plugins modules are loaded with sceKernelLoadStartModule(path, 16, {16, 0x200, ...}). Their module entry checks that argument and refuses with PSN is an old version that cannot be used by the current player runtime when it is missing, so the arguments must reach DT_INIT.
• The two agc_driver Vulkan tests agc_driver_lds_atomics64 and agc_driver_vopc_compare_table fail on this host on main. More agc_driver tests fail when run in parallel or while a title uses the GPU.

Stack tried (2026-10-08)

main at e76c70f6 (2026-10-06), plus pull requests that were open then and are now merged (#285, #369, #696, #700, #702, #709, #721, #724, #734, #760, #763, #839, #840, #841, #842, #844, #893, #903, #904, #1387). Open pull requests: #846 (with #716), #425, #374. Local: stand-ins for #518's and #407's functions, the visible-keys classification for blocker A, and eager write-back of the glyph images.

[merwie]

Progress update (2026-10-06): PPSA12544 now goes from the title through the intro cinematic into gameplay, with keyboard input, at 60 fps.

New fixes:

• fix(avplayer): deliver the frame at a jump while paused #893: the AvPlayer frame at a jump is delivered while paused, so the cinematic plays.
• feat(libkernel): deliver sceKernelRaiseException on Windows #760: a redirected exception delivery now takes its context from rsp and the live registers, since sysret overwrites rcx.
• sceKernelGetModuleInfoForUnwind: reports the guest eh_frame_hdr, so IL2CPP exceptions are caught instead of terminating. Pull request to follow.
• feat(agc): depth surfaces read as textures and storage images #425 (not mine) adds the depth and stencil reads the first scene needs.

Main open problem: storage-image results dropped by the keep-CPU-blocks rule (#865). It leaves menu glyphs boxed and, after a room transition, a dark foreground layer stuck on screen. Details and test results are in #865.

[merwie]

Update: the stuck dark foreground layer is tied to 1920x1080 storage images. Writing back only those eagerly (a local switch, plus the 512x512 and 256x256 glyph images) lets the layer fade out after a room transition as it should, and fixes the boxed menu glyphs. It costs about a third of the frame rate (~42 fps instead of 60), so it is an interim setup, not a fix. Eager write-back of every image except the 1920x1080 ones does not help. No texture lookup reports a miss on those images, so the stale read must come through a path that does not call StorageTexture::FlushPending. That is what I am looking for next. Findings go to #865.

[merwie]

Update: #839 (AudioOut2 grain timing) is updated after review. It now has a CI test on the SDL disk audio driver (audio_out2_timing: next-push read, queue level beyond the cushion, priming after running dry) that fails on main. The 100 µs read delay no longer holds the context lock, and the no-device and pad paths behave as on main again. Gameplay status is unchanged since my last post: the stuck silhouette after room transitions is still worked around locally by eager write-back of the 1920x1080 storage images (#865 family), at about 42 fps.

[merwie]

Update (2026-10-08): the post above is refreshed. PPSA12544 is now playable at 60 fps on my stack.

• The dark layer that stuck after room transitions is fixed by fix(agc): store uncompressed DCC keys at the first write of a fast-cleared image #903 (merged). Draws into a fast-cleared render target left its DCC keys at the clear code, so the next fast clear with the same code went unseen. The bisection is in agc-driver: storage image write-back drops GPU results for CPU-stamped 64 KiB edge blocks (boxes in Silksong's menu text) #865.
• Merged since my last update: feat(libkernel): deliver sceKernelRaiseException on Windows #760, fix(audioout2): read grains at the next push and play them behind a cushion #839, feat(agc): implement sceAgcDriverGetEqContextId #844, fix(avplayer): deliver the frame at a jump while paused #893, fix(libkernel): report guest unwind tables in sceKernelGetModuleInfoForUnwind #904, fix(agc): decide an edge unit's CPU keep from the pages the unit overlaps #1387, and the rest of the original stack. Still open for this title: feat(relinker): add --module-dir for modules loaded at run time #846, feat(agc): depth surfaces read as textures and storage images #425 and two functions of feat(libs): Deathloop loading support (Ampr, NetCtlApDialog, Party + stubs) #407.
• The boxed menu glyphs remain. The cause is in agc-driver: storage image write-back drops GPU results for CPU-stamped 64 KiB edge blocks (boxes in Silksong's menu text) #865: CPU stamps that change no bytes on the unaligned atlas edge blocks make the write-back drop the GPU glyphs. I proposed an edge-only byte merge there.