LOADADDR 0x90000 overlaps a chunk of the kernel

[AKuHAK]

ps2sdk/ee/elf-loader/src/loader/Makefile

Line 11 in 202279e

LOADADDR = 0x90000

krHACKen recently discovered that address 0x90000 overlaps a chunk of the kernel.

To reproduce it, dump the EE kernel while the console is in the OSD, look at offset 0x00090000, scroll down to see where it ends.
Then execute the wLE, run an ELF, and dump the kernel area again to see corruption starting from 0x00090000.
Also it'd be useful to dump the kernel $gp, $sp and $fp to have a better idea of where to load our apps.
moving the loader to 0x00092000 so it doesn't corrupt the kernel fixed the issues
Not sure that it's true for all bootroms, but the min load address I got from several kernel dump was 0x91630.

[AKuHAK]

#129

[sp193]

Are you certain it is used by the kernel, and not just the OSD itself? OSDSYS, being made by Sony, might have some privilege to use the undocumented user memory.

It is not part of KSEG from what I know. The only user-mode region used by the kernel is at 0x00080000-0x00082000, which contains the idle thread and alarm dispatcher (which gets replaced with a new version that is copied to 0x00082000 by new software).

We have also been using this region of memory for a lot of things, from OPL to FMCB.

[AKuHAK]

Yeah, I thought that it was a piece of OSD code. But the corruption causes SIF issues in the DVD Player on run time.

[sp193]

But when software does proper handing off, there will be no problems. The hardware is mostly managed by libraries that come with the software. The SIF itself is just a set of 3x DMA channels. SIFCMD is a low-level library for sending packets across these channels, while SIFRPC is the highest-level library provides RPC. On the IOP, SIFCMD and SIFRPC are combined in just "SIFCMD". Perhaps it was originally that way. SIFCMD and SIFRPC exist as libraries that are built into the software, rather than the EE kernel itself.

The OSD boots the DVD player with LoadExecPS2(). This syscall wipes all memory (0x00082000 and above) and copies EELOAD to 0x00082000. It's not possible for the OSD to leave things in memory, other than kernel updates.

You wrote that krHACKen discovered this, but what is the context?

[AKuHAK]

New FDVD exploits in old FAT consoles use this range of memory at load time( 0x90000 - 0x92000 ), so any app just crashes at boot. But now I am not sure that this issue is definitely related to ps2sdk.