Boot hangs when CD search and IOP module loading depend on BIOS LOADFILE/CDVDFSV servers

Open
  • Is something wrong?
#358 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 5 days

@AlenDavid is already working on this.

Since Oct 18, 2026.

  • #359 by @AlenDavid — open
  • #403 by @LeandroSSB — open

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
cpp
Domain
game-dev, reverse-engineering

Research direction

Start from IopEmulator::loadModuleBuffer, the untracked-stub handling, and the guest implementations of sceCdLayerSearchFile and sceSifSearchModuleByAddress. Verify that CDVDFSV/LOADFILE calls cannot enter indefinite retry loops and that IRX module buffers are read from IOP RAM, then boot SLUS-21735 and confirm all 13 modules load. The separate sceSifAllocIopHeap failure is explicitly out of scope; an open linked pull request already targets this issue.

Written by the indexing model from the issue text.

Description

Mana Khemia: Alchemists of Al-Revis (SLUS-21735), recompiled with the analyzer-generated config, hangs during boot without any error message. There are three separate causes, each hit only after the previous one is fixed.

1. sceCdLayerSearchFile spins on CDVDFSV's RPC

The game looks up \RPK.BIN;1 with sceCdLayerSearchFile (0x00485230). The runtime has no handler by that name, so the analyzer lists it under untracked_stubs and the guest libcdvd code runs. That code binds SID 0x80000597, which only CDVDFSV registers. The IOP emulator runs without a BIOS and sceSifRebootIop ignores the IOPRP310.IMG path, so the server never appears and the SDK keeps retrying the bind (cd->server == NULL) forever.

2. sceSifLoadModuleBuffer reads the module from the wrong memory

The game copies each IRX to IOP RAM with sceSifSetDma and passes that IOP address to _sceSifLoadModuleBuffer. The runtime writes the DMA into the emulator's separate IOP RAM, but IopEmulator::loadModuleBuffer reads the address from EE RAM (IopHost::readGuest), finds no ELF header and returns -1 without logging anything. None of the game's 13 modules load (DBCMAN, SDRDRV, EzMIDI, CRI ADX…), so it then waits on DBCMAN's SID 0x80001300 forever.

3. sceSifSearchModuleByAddress spins on LOADFILE's RPC

After the first module loads, the game calls sceSifSearchModuleByAddress (0x00476098). The runtime has no handler for it either, so the guest version binds LOADFILE (SID 0x80000006), which is also a BIOS module, and spins in _lf_bind.

After fixing all three

All 13 IRX modules load and start. The game then stops at a separate, unrelated problem: PS2RNA: E01112903: Failed, sceSifAllocIopHeap(%d) in ps2rna_init_psj, followed by the game's own for(;;) error loop.

Found on macOS arm64 with eb8688b.

Dominant language
C++
Stars
3.3k
Forks
149
Avg merge
8h 46m
Merged PRs (30d)
1

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ran-j/PS2Recomp

All issues in ran-j/PS2Recomp

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.