Finally I did it,
So, I recently workin on reverse-engineering the Sony PlayStation 4 Pro memory subsystem under PS4Linux kernel, specifically targeting the auxiliary 1GB DDR3 DRAM managed by the Belize Southbridge co-processor.
On Orbis OS, this isolated 1GB pool is exclusively for OS asset swapping and background app parking. When running Linux, this memory remains completely unutilized because it is entirely separated from the APU's unified high-speed GDDR5 main memory controller.
So, I build a custom Linux Kernel module to hook onto this unmapped hardware and mount it natively as a zero-latency system swap device.
Engineering Roadblocks
Strict Bus Protocol: My early testing using direct memory mapping triggers immediate Input/output error exceptions. The Belize memory bus controller aggressively drops or faults any read/write transaction that isn't cleanly aligned to a strict 32-bit boundary so standard loops immediately stall the system.
ACPI/Device Tree Isolation: The PS4 have no standard PC like BIOS/ACPI tables, the initialization payload maps out the early E820 hardware boundaries. The memory space spanning 0x80000000 - 0xDFFFFFFF was explicitly flagged as SMAP_TYPE_RESERVED.
Kernel Validation blocks: On Linux kernels like v6.x, the virtual block layer (blk-mq) natively rejects non-PCI block driver allocations via add_disk() if it cannot identify an explicit struct device parent tracking node hierarchy inside sysfs.
So, the best part my 💡Multi-Layered Engineering Solution
Added Payload Carving modified the primary jailbreak kexec() loader payload source (linux_boot.c) to cleanly cut the rigid "Reserved" hardware block and declare the first 1GB slice (0x80000000 with a size of 0x40000000) as safe system MEMORY.
The blk_mq Parent Injection Bypass abandoned standard virtual device structures. Leveraged deep kernel internal abstractions (blk_mq_alloc_disk) to manually inject a custom pseudo-root device tracking parent inline (disk->part0.bd_device.parent).
Strict Word-Pacing IO Loops implemented a dedicated transaction wrapper utilizing ioread32 and iowrite32 streaming chunks to satisfy the co-processor's hardware bus constraints perfectly.
So the Output-
The driver compiles perfectly on my custom 6.8.12 debug kernel source. On boot, the kernel cleanly registers the device node at /dev/ps4pro_ddr3 as a true block storage format structure HELL YEAH
Btw I'm also a Kernel Contributor for PS4linux developer community so yeah u know..
My next Architecture in simple word-
run linux on 1gb DDR3 and use hole GDDR5 pool as a game memory on PS4pro like a true PS4 but on Linux I will see about that later....
Top comments (0)