Hollow Knight: Silksong (PPSA12544)

[merwie]

Tested

• Title: Hollow Knight: Silksong, PPSA12544, content version 01.000.010 (master 01.02, SDK 0x11000000). Unity, IL2CPP, FMOD.
• Host: Windows 11 Pro, AMD Ryzen 7 9800X3D, Radeon RX 9070 XT. Built with WinLibs GCC 15.2.0 r7.
• Relink: relinker --windows --registry --module-dir Media/Modules --module-dir Media/Plugins app0/eboot.bin Silksong.exe (no --to-intel).
• Dump: fake-signed SELFs (eboot.bin, sce_module/*.prx, Media/Modules/*.prx, Media/Plugins/*.prx), unwrapped to plain ELF before relinking.
• Last update: 2026-10-11

Status

Playable at 60 fps on plain main (a11c8f7), with no open pull requests, no local patches and no environment switches. The game boots, menus and their text render correctly, audio plays without crackle, keyboard input works, the intro cinematic plays, and a new game reaches gameplay with working room transitions.

• Dark layer stuck after room changes: fixed by fix(agc): store uncompressed DCC keys at the first write of a fast-cleared image #903.
• Boxed menu glyphs: fixed by fix(agc): store GPU results over CPU-stamped bytes the CPU left unchanged #1599 (analysis in agc-driver: storage image write-back drops GPU results for CPU-stamped 64 KiB edge blocks (boxes in Silksong's menu text) #865).
• Unity TLSF allocator crash (heap corruption while assets stream): seen about 4 times in a dozen runs on 2026-10-06, not seen in the runs since 2026-10-08. Cause not found.

Correction (2026-10-06): an earlier version of this post, and a comment on #648, said the output looked correct. I had not checked it: every presented frame was black. The cause was draws skipped for PA_SC_MODE_CNTL_1 bit 17 (#840).

Still needed beyond main

Nothing. #846 (--module-dir) is merged. #425 is not needed on current main (see the stops table). The local stand-ins for #518's and #407's functions and the visible-keys workaround for blocker A are gone.

Stops, in the order they were hit

All covered on current main.

Stop	Covered by
Unsupported special symbol section in Il2cppUserAssemblies.prx (151 SHN_ABS marker symbols)	#698
Failed to load module ... libs\Il2cppUserAssemblies.prx (needed modules in Media/Modules, outside sce_module)	#716
Unresolved imports (Font, Http2, Net, Pad, Ssl, SystemService, UserService, libkernel, POSIX)	#699
Unresolved imports: sceKernelSyncOnAddressWait32/64	#633
Unresolved imports: dbOlWdppb4o (libSceAgc)	#651
Unresolved imports: the three libSceLibcInternalExt thread-exit functions	#641
Unresolved imports: sceVideoOutVrrPegToFixedRate, sceVideoOutVrrUnpegFromFixedRate	#518
Access violation in the first allocator commit: sceKernelVirtualQuery returns EACCES inside a reserved range	#700
NH6xARDOVv8 not implemented (sceKernelGetOperationMode)	#699
sceUserServiceGetAgeLevel not implemented	#705
sceKernelIsStack not implemented	#702
validateOutputConfig: VIDEO_OUT_ERROR_UNSUPPORTED_OUTPUT_MODE (probe of 0xd000000a), then sceVideoOutConfigureOutput throwing instead of returning UNAVAILABLE_OUTPUT_MODE	#709
expected JSON object in param.json (defaultLanguage inside localizedParameters, only en-GB)	#710
VideoOut: DCC presentation is not implemented	#648, #647
sceKernelCheckedReleaseDirectMemory not implemented	#721
Null il2cpp_set_find_plugin_callback: sceKernelLoadStartModule("/app0/Media/Modules/Il2CppUserAssemblies.prx") returned 0x80020002	#717
sceKernelInstallExceptionHandler not implemented	#724
sceKernelRaiseException not implemented (Unity's GC stops threads with SIGUSR1; targets blocked in libkernel waits)	#760 (Windows), design in #727
Divide by zero in managed code after the first GC: the main thread's stack was reported as null/0, so the GC freed live objects	#761
DllNotFoundException: Unable to load DLL 'PSN' (native plugins in Media/Plugins, loaded at run time)	#846 (--module-dir Media/Plugins)
Failed to load module ... libSceVrSetupDialog.prx and other plugin imports	#763, #734, #369; the two functions from #407 are on main now
unresolved ELF import wTpfglkmv34 (sceMsgDialogProgressBar* from libSceMsgDialog.native)	#762
SaveDataException (0x809F0005): the executable and the SaveData plugin both call sceSaveDataInitialize3	#841
sceImeKeyboardGetResourceId not implemented	#696
sceAppContentDownloadDataGetAvailableSpaceKb: the title declares no download data	#842
compute shader ...: AGC graphics: unsupported descriptor role Gds	#285
sceAgcDriverGetEqContextId not implemented	#844
VideoOut: display buffer ... reads mixed DCC keys ... at the first flip	no longer occurs on current main
All presented frames black: skipped draw: sample iteration, primitive discard or out-of-order rasterization is unsupported (register 0x293 = 0x06020000)	#840
Intro cinematic stays black: a paused AvPlayer delivered no frame after JumpToTime	#893
Crash after the cinematic: sceKernelGetModuleInfoForUnwind reported no eh_frame_hdr on Windows, so the title's own libc could not unwind any C++ (IL2CPP) exception	#904
Crash in exception delivery: a thread redirected inside a system call resumes through sysret, which overwrites rcx	#760
First scene: sampling the stencil/depth plane of depth surface ... is not implemented	covered on current main without #425; likely #3277 (not traced)
Audio crackle: AudioOut2 read each grain at push time, while FMOD fills the buffer after pushing it, and reported an empty queue	#839
Dark foreground layer stuck after a room transition	#903 (#865)
Some menu letters render as solid boxes	#1599 (#865)
AGC driver: missing static shader ABI register 201 at startup (shaders registered without their program address registers)	#1836
Failed to load module ... Il2cppUserAssemblies.prx again after #2708 limited the module search to sce_module/sce_modules/prx	#846 (--module-dir Media/Modules)

Notes

• PS5Util (Unity) and exception handlers: gc_stop_init installs a SIGUSR1 handler that reads uc_mcontext.mc_rsp (offset 0xf8 of the PS5 ucontext) and raises SIGUSR1 on each thread to stop it for collection. Design: Exception handler delivery (sceKernelRaiseException, fault handlers) #727.
• Media/Plugins modules are loaded with sceKernelLoadStartModule(path, 16, {16, 0x200, ...}). Their module entry checks that argument and refuses with PSN is an old version that cannot be used by the current player runtime when it is missing, so the arguments must reach DT_INIT.
• The two agc_driver Vulkan tests agc_driver_lds_atomics64 and agc_driver_vopc_compare_table fail on this host on main. More agc_driver tests fail when run in parallel or while a title uses the GPU.

Stack tried (2026-10-11)

main at a11c8f7f only.

[merwie]

Progress update (2026-10-06): PPSA12544 now goes from the title through the intro cinematic into gameplay, with keyboard input, at 60 fps.

New fixes:

• fix(avplayer): deliver the frame at a jump while paused #893: the AvPlayer frame at a jump is delivered while paused, so the cinematic plays.
• feat(libkernel): deliver sceKernelRaiseException on Windows #760: a redirected exception delivery now takes its context from rsp and the live registers, since sysret overwrites rcx.
• sceKernelGetModuleInfoForUnwind: reports the guest eh_frame_hdr, so IL2CPP exceptions are caught instead of terminating. Pull request to follow.
• feat(agc): depth planes sampled as 2D arrays, cubes and integer views #425 (not mine) adds the depth and stencil reads the first scene needs.

Main open problem: storage-image results dropped by the keep-CPU-blocks rule (#865). It leaves menu glyphs boxed and, after a room transition, a dark foreground layer stuck on screen. Details and test results are in #865.

[merwie]

Update: the stuck dark foreground layer is tied to 1920x1080 storage images. Writing back only those eagerly (a local switch, plus the 512x512 and 256x256 glyph images) lets the layer fade out after a room transition as it should, and fixes the boxed menu glyphs. It costs about a third of the frame rate (~42 fps instead of 60), so it is an interim setup, not a fix. Eager write-back of every image except the 1920x1080 ones does not help. No texture lookup reports a miss on those images, so the stale read must come through a path that does not call StorageTexture::FlushPending. That is what I am looking for next. Findings go to #865.

[merwie]

Update: #839 (AudioOut2 grain timing) is updated after review. It now has a CI test on the SDL disk audio driver (audio_out2_timing: next-push read, queue level beyond the cushion, priming after running dry) that fails on main. The 100 µs read delay no longer holds the context lock, and the no-device and pad paths behave as on main again. Gameplay status is unchanged since my last post: the stuck silhouette after room transitions is still worked around locally by eager write-back of the 1920x1080 storage images (#865 family), at about 42 fps.

[merwie]

Update (2026-10-08): the post above is refreshed. PPSA12544 is now playable at 60 fps on my stack.

• The dark layer that stuck after room transitions is fixed by fix(agc): store uncompressed DCC keys at the first write of a fast-cleared image #903 (merged). Draws into a fast-cleared render target left its DCC keys at the clear code, so the next fast clear with the same code went unseen. The bisection is in agc-driver: storage image write-back drops GPU results for CPU-stamped 64 KiB edge blocks (boxes in Silksong's menu text) #865.
• Merged since my last update: feat(libkernel): deliver sceKernelRaiseException on Windows #760, fix(audioout2): read grains at the next push and play them behind a cushion #839, feat(agc): implement sceAgcDriverGetEqContextId #844, fix(avplayer): deliver the frame at a jump while paused #893, fix(libkernel): report guest unwind tables in sceKernelGetModuleInfoForUnwind #904, fix(agc): decide an edge unit's CPU keep from the pages the unit overlaps #1387, and the rest of the original stack. Still open for this title: feat(relinker): add --module-dir for modules loaded at run time #846, feat(agc): depth planes sampled as 2D arrays, cubes and integer views #425 and two functions of feat(libs): Deathloop loading support (Ampr, NetCtlApDialog + stubs) #407.
• The boxed menu glyphs remain. The cause is in agc-driver: storage image write-back drops GPU results for CPU-stamped 64 KiB edge blocks (boxes in Silksong's menu text) #865: CPU stamps that change no bytes on the unaligned atlas edge blocks make the write-back drop the GPU glyphs. I proposed an edge-only byte merge there.

[merwie]

Update (2026-10-11): Silksong is playable on plain main (a11c8f7) on Windows: no open pull requests, no local patches and no environment switches. Menus, text and gameplay render correctly at about 60 fps.

• The last pieces landed: feat(relinker): add --module-dir for modules loaded at run time #846 (--module-dir, relink with --module-dir Media/Modules --module-dir Media/Plugins), fix(agc): store GPU results over CPU-stamped bytes the CPU left unchanged #1599 (boxed menu glyphs), fix(agc): defer shaders that cannot be prepared at registration to their first use #1836 (shaders registered without program address registers).
• feat(agc): depth planes sampled as 2D arrays, cubes and integer views #425 is no longer needed for this title: the first-scene depth/stencil sampling stop does not happen on current main, likely thanks to fix(agc): treat other-shaped views of a depth surface's stencil plane as reused memory #3277 (not traced).
• Blocker A (mixed DCC keys at the first flip) does not occur on current main either.

The post above is updated.

[merwie]

Video: https://cdn.discordapp.com/attachments/1557615587981795378/1558853226952921158/compressO-2026-10-11_16-22-21.mp4?ex=6accf2b3&is=6acba133&hm=91540ceb9dd7903c67f971ae5466ae32a5c6b30f8e62c3cd3d4344239a40e24b&