Is there a way to load and store data to KSEG0? If I ask Naplink to load a elf file to 0x80001000, PS2 just hang. Is it because Naplink is running in user mode?
Yes. Only the kernel runs in kernel mode. To access KSEG0 you have to switch the processor into kernel mode by setting the appropiate bits in the Status register on COP0. See ps2lib's kernel.h header for two inline macros, ee_kmode_enter() and ee_kmode_exit() that will do this for you.