Boot Sequence

Syscon
Syscon powers up and sets up DRAM, sets up boot context buffer, turns on the cmep processor that starts the Boot ROM.

Boot ROM
The PS Vita main application processor is an ARM Cortex A9 MPcore. It implements ARM TrustZone for execution in both a non-secure world and a sandboxed Secure World. However it is not the first processor to run on boot.

The cmep processor is the actual secure boot device rather than the ARM processor. The cmep processor bootrom ("first loader") is the first code running on PS Vita start. Once it starts it likely maps the eMMC and directly reads in the second_loader.enp or second_loader.enp_ from the eMMC SLB2 partition. This is in the native load format of the bootrom. There are 2 layers of encryption. First it decrypts the per-console layer that was added during the firmware installation. After that it decrypts the factory-encrypted layer then begins execution. See Enc.

The Second Loader is primarily responsible for preparing the ARM processor. It initializes DRAM and decrypts kernel_boot_loader.self from eMMC SLB2 partition into DRAM. It also writes the ARM exception vector and some boot context information to the 32kB scratch buffer (mirror mapped to 0x00000000 on ARM). kernel_boot_loader.self contains both the secure kernel bootloader and TrustZone, as well as the non-secure kernel bootloader. At this point the kprx_auth_sm.self and prog_rvk.srvk read from the eMMC SLB2 partition are both loaded into DRAM. Finally, the Second Loader resets itself with a pointer to the secure_kernel.enp or enp_ binary.

Cmep processor then restarts and loads the secure_kernel.enp in and again decrypts the per-console layer that was added during the firmware install, and the factory layer. At this point the cmep processor is prepared and Secure Kernel tells Syscon to reset the ARM CPU at 0x00000000 (cmep scratch buffer). This triggers the ARM secure boot process.

Secure Kernel Bootloader
The secure kernel bootloader decompresses the ARZL compressed TrustZone kernel, loads it and sets up the VBAR and MVBAR. It then decompresses the ARZL non-secure kernel bootloader, sets NS in SCR and jumps into non-secure kernel bootloader with svc mode. See Kernel Boot Loader for more information.

Non-secure Kernel Bootloader
The non-secure kernel bootloader contains an embedded and likely stripped version of SceSysmem, SceKernelModulemgr, SceSblSmschedProxy, and some other core drivers. The NSKBL sets up the eMMC device (again) and starts.

ScePsp2BootConfig
This kernel module does not export any library. It only has a module init function that has a hard coded list of core kernel modules (ex: sysmem.skprx) which are loaded with calls back into NSKBL through SceKblForKernel imports. Once the core initialization is done, the next module to run is SceSysStateMgr.

FW 0.931 special case
On FW 0.931, NSKBL embeds the kernel modules list in data segment instead of using the ScePsp2BootConfig kernel module. Here is the list:

SceSysStateMgr
This kernel module also does not export any library. Its init function first maps all the SceKernelBootimage embedded modules and redirects them to os0:kd/. Then it decrypts  or   or   and parses the System Configuration Script to load the remaining modules and finally either SceSafemode or SceShell or ScePsp2Swu or ScePsp2Diag.

Boot Partition
The boot partition is SLB2 formatted. It contains entries these files:

System Configuration Script
also see : SceSysStateMgr

once decrypted is a UTF-8 text file that is parsed by SceSysStateMgr. It is a very simple script format.

If "Producting Mode" (MANUFACTURING_MODE) is enabled, then it is possible to load  from   (SD adapter in GameCard slot) or. However, the files must still be signed and encrypted SELFs. In "Producting Mode" if  or   exists (and is a valid signed and encrypted SELF), then it will be launched. If "Development Mode" (DEVELOPMENT_MODE) is enabled (note that this does not necessarily mean PDEL or devkit), then  can be a plaintext file instead.

Comments
Comments start out with.

As an example, here is the header of FW 1.69 psp2config.skprx:
 * 1) PSP2 System Configuration for Release
 * 2) [NOTICE]
 * 3) This configuration is only for kernel_boot_loader_release.self.
 * 1) [NOTICE]
 * 2) This configuration is only for kernel_boot_loader_release.self.
 * 1) This configuration is only for kernel_boot_loader_release.self.

Conditionals
Conditionals start with  and end with. There are certain conditional constants defined in SceSysStateMgr. A table of known conditionals is below.

Example: if SAFE_MODE spawn	os0:ue/safemode.self end endif

Spawn
will spawn an app and continue processing the script in the background.

will spawn an app and wait for it to exit before continuing processing the script.

is used to spawn the app self located at  with the parameter.

Known param constants:

All codes (from FW 0.990)
load, unload, loadonly, start, stop, unloadonly, spawn, spawnwait, wait, kill, loadconfig, ifmodel, ifnmodel, setenv, setmodfile, repeat, endrepeat, appspawn, tload

+ include, if, endif, end

Boot Debug Checkpoint Codes
During the boot sequence, the various bootloaders will update a GPIO register specifying the progress into boot. This can be used to debug where in the boot process something fails.

GPIO
The GPIO registers are registered at  (turn off bits) and   (turn on bits). On PDEL units, this maps to the LED lights.

Suspend and Resume
Upon suspension, context is written to memory and a syscon command is issued to save the context pointer as well as other information (for example, if it should restart into update mode). When resuming, the boot process is the same as cold boot up until the secure kernel bootloader. After secure kernel loads, instead of decompressing and jumping to the non-secure kernel bootloader, it restores the saved context and returns to the kernel resume code.

See also Suspend.