Initial Program Loader
Jump to navigation Jump to search
IPL Boot Sequence
The decrypted IPL is composed of 3 parts: Part1 - the 'loader', Part2 - 'main.bin', and Part3 - the 'payload'. Part1 is plaintext MIPS code, Part2 is gzip compressed, and Part3 is again encrypted (from 2.60 onwards, parts 2 & 3 are further encrypted again).
Part1 IPL (the loader)
One of the first things Part1 IPL does is reset the main CPU. After reset the preipl mask ROM device is no longer mapped to memory at all (the 0x1FC00000 address range is then remapped to the 4KB RAM mentioned above to be used for the ME reset vector). This is why the preipl is no longer accessable once the IPL has booted. The Part1 IPL does some very basic hardware inits and decompresses the gzipped Part2 IPL (main.bin) to address 0x04000000 (still in EDRAM). Part1 IPL then jumps to the entry address of main.bin (0x04000000) to initialise the hardware.
Part2 IPL (main.bin)
Part2 IPL (main.bin) is responsible for initialising the PSP hardware. It has copies of it's own driver libraries similar to the drivers found in the firmware (including: sceNAND_Driver, sceDDR_Driver, sceIdStorage_Service, sceSYSREG_Driver, sceSYSCON_Driver, sceGPIO_Driver, sceClockgen_Driver, & sceI2C_Driver). Some of the initialisation of the hardware depends on data stored in idstorage keys (for example keys 4,5,6). Note this is where TA082/086 motherboards 'brick' on 1.50 firmware. The clockgen hardware was changed on TA082/086 motherboards so the functions used to initialise it does not recognise the new hardware. And because part of the initialisation depends on data stored in key5, simply by invalidating key5 (by corrupting the header), the initialisation is skipped allowing the firmware to continue to boot. After initialising the hardware (including the DDR RAM), Part2 IPL decrypts the Part3 IPL (the payload) and loads it to address 0x08400000 (which is located in normal DDR RAM now that it has been initialised). It then jumps to the entry address of the Part3 IPL (0x08400000) to boot the firmware.
Part3 IPL (the payload)