Difference between revisions of "Hardware"

From WiiBrew
Jump to navigation Jump to search
m (Added the hardware navbox)
 
(42 intermediate revisions by 18 users not shown)
Line 1: Line 1:
===CPU===
+
The [[Wii]]'s hardware is one of the most well-understood of any home console. Due to extensive research in the homebrew community, the Wii's inner workings have been reverse-engineered and have been exploited heavily in the usage of homebrew.
* IBM '[http://en.wikipedia.org/wiki/Broadway_%28microprocessor%29 Broadway]' 90 nm based on IBM's Power architecture.
 
*Runs at a speed of 729 MHz. Maximum Bandwidth is 1.9 GB/s.
 
*Bus to main memory: 243 MHz, 64 bits (maximum bandwidth: 1.9 GB/s)
 
*32 KB 8-way set-associative L1 instruction cache
 
*32 KB 8-way set-associative L1 data cache (can set up 16-kilobyte data scratch pad)
 
*Superscalar microprocessor with six execution units (floating-point unit, branching unit, system register unit, load/store unit, two integer units)
 
*DMA unit (15-entry DMA request queue) used by 16-kilobyte data scratch pad
 
*Write-gather buffer for writing graphics command lists to the graphics chip
 
*Onboard 256-kilobyte 2-way set-associative L2 integrated cache
 
*Two, 32-bit integer units (IU)
 
*One floating point unit (FPU) (supports single precision (32-bit) and double precision (64-bit))
 
*The FPU supports paired single floating point (FP/PS)
 
*The FPU supports paired single multiply add (ps_madd). Most FP/PS instructions can be issued in
 
each cycle and completed in three cycles.
 
*Fixed-point to floating-point conversion can be performed at the same time as FPU register load and store, with no loss in performance.
 
*The branch unit supports static branch prediction and dynamic branch prediction.
 
*When an instruction is stalled on data, the next instruction can be issued and executed. All instructions maintain program logic and will complete in the correct program order.
 
*Supports three L2 cache fetch modes: 32-Byte, 64-Byte, and 128-Byte.
 
*Supports these bus pipeline depth levels: level 2, level 3, and level 4.
 
Reference Information: Broadway is upward compatible with Nintendo GameCube’s CPU (Gekko).  
 
  
*Broadway CPU version is 87102, Gekko is 83410. Source: http://forum.wiibrew.org/viewtopic.php?t=210
+
== Introduction ==
*Information about its [[Broadway:Registers|registers]] is available
 
  
===Graphics===
+
=== Processors ===
* ATi '[[Hollywood]]' processor
+
The Wii has two processors. The main processor of the Wii's system, codenamed Broadway, which is a PowerPC processor that does the job of running executable code, and interfacing with legacy hardware, which includes every aspect of the Gamecube's system, with a few exceptions, which aree handled by the PowerPC. The Broadway is also called the PPC, because that is its architecture.
*Runs at a  speed of 243 MHz.
 
Includes:
 
*Graphics processing unit (with 3 MB of eDRAM)
 
*Audio DSP
 
*I/O Bridge
 
*24 MB of internal main memory
 
*Internal main memory operates at 486 MHz.
 
Maximum bandwidth between Hollywood and internal main memory: 3.9 GB/s
 
*Possible to locate a program here
 
Reference Information: Hollywood is similar to Nintendo GameCube’s Flipper and Splash components.  
 
  
The Hollywood is a multi-chip package composed of two dies, named Vegas and Napa. Vegas is the GPU, and is also responsible for I/O functions, including memory access. Napa is the DSP, and includes 24 MiB of 1T RAM on the die. Vegas has direct access to 3 MiB of 1T RAM for use as a frame buffer and texture storage.
+
The other processor is nicknamed the Starlet chip, due to the fact that it lives inside the Hollywood graphics processor. The Starlet is an ARM processor that communicates with hardware, as well as the DVD drive. The program that handles communication between the PPC and the hardware is known as [[IOS]].
  
* Qimonda HYB18HS1232 64 MiB GDDR3 graphics RAM
+
The reason for this dual-processor layout was security. Before the Wii was homebrewable, people used Gamecube homebrew instead. However, Gamecube homebrew, because of this layout, could not access any of the Wii's hardware, as [[MIOS]] running on the ARM locked down all of the Wii's hardware so it could not be used until a reboot occurred.
  
See [[Video Output]] for more information on the output connectors and the available video modes.
+
[[NAND]] is the term for the Wii's internal flash memory, which is based on a NAND flash.
  
===Memory===
+
=== Bootloaders ===
* Elpida S1616AGTA 16-Mbit SDRAM
+
All three bootloaders that the Wii has all run on the ARM, before the Wii's system actually boots. Due to the security, the ARM has no access to the screen at all.
* Samsung K9F4G08U0A 65-nm, 4-Gbit NAND flash
 
* 64 MB of GDDR3 (MEM2) as the external main memory. Can be accessed from the CPU and GPU with a bandwidth of 4GB/s and can also store programs in the MEM2.
 
  
===Optical Drive===
+
[[boot0]] is stored in ROM inside Hollywood - so it cannot easily be replaced. It is extremely simple, and its job is to check the hash of [[boot1]] before booting into boot1.
* Supports single sided 4.7 GB and double sided 8.51 GB discs. Nintendo GameCube discs are also supported.
 
  
===Wireless===
+
boot1 is stored in NAND, but its hash is stored in OTP memory inside Hollywood. Like boot0 this means that boot1 cannot be modified. Its job is to initialize the RAM of the Wii, then perform a signature check of boot2. Making boot1 separate from boot2 allowed Nintendo to change the RAM of the Wii, which would then need slightly different initialization, without updating Hollywood. The OTP is programmed very late in Hollywood's production, as opposed to the ROM which is tightly ingrained into the chip.
* Broadcom BCM4318 Wi-Fi transceiver
 
* Broadcom BCM2045 [[Bluetooth]] device connected via USB
 
  
==References==
+
[[boot2]] is stored in NAND, as is its signature. It is a stripped down IOS. This is therefore responsible for initializing some of the Wii's hardware. It reads the System Menu's TMD to find out what IOS it uses and requires, before booting into the IOS required by the system menu.
# http://www.techonline.com/showArticle.jhtml?articleID=194500380
+
 
# http://techon.nikkeibp.co.jp/english/NEWS_EN/20061127/124495/
+
=== IOS ===
 +
The Wii has several operating systems which act independently. These operating systems are known as [[IOS]]es. IOS is the software that controls communications between the PPC and the Wii's hardware, via on the ARM. To aid in backwards-compatibility, each IOS has its own version number and be stored alongside all the other IOSes on the system. This means when new elements are implemented into IOS, each game can still have just the IOS that it originally had. Each game, channel and System Menu chooses which IOS to run. If it detects that the IOS it requires is not installed, the Wii alerts the user to perform a system update. This in practice is impossible without homebrew, as the system menu forces installation of updates from disc-based games before they can be played, and The Wii Shop Channel cannot be accessed without the latest update normally. This has disadvantages that were targetted by homebrew. Because of the large amounts of IOSes on the Wii's system, if a fatal bug is discovered in all of them, it takes a long time to update, test, and deploy. Since homebrew can also reload into a different IOS version during runtime, a flaw in just one IOS can bring the entire system's security down. This also means that if somehow one IOS is expected but not installed, this can cause issues with games and channels. Including some games/channels not working, or bricking.
 +
 
 +
The Wii has many IOSes that are stubbed, some of these stubbed IOSes were previously used by the System Menu, reducing them to a non-functional stub of what they used to be.
 +
 
 +
==== Signature Checks ====
 +
The IOS performs a signature check on any channel being attempted to be installed on the system, or boot2 when the Wii is about to be booted. The Trucha Bug is the main way to work around this signature check - it has been exploited in the past for many things, and is exploited mainly to install [[BootMii]] under boot2.
 +
 
 +
== Nintendo Wii Hardware Summary ==
 +
*'''CPU:''' IBM PowerPC '''729 MHz'''
 +
*'''GPU:''' ATI graphics '''243 MHz'''
 +
**3 MB embedded memory
 +
*NEC ARM9 '''243 MHz'''
 +
*'''512 MB''' Internal Flash Memory (NAND)
 +
*'''88 MB''' Main Memory
 +
**24 MB "internal" 1T-SRAM
 +
**64 MB "external" GDDR3 SDRAM
 +
*12 cm optical drive
 +
*Wi-Fi  '''802.11b/g'''
 +
**Mitsumi DWM-W004
 +
*Bluetooth
 +
*2x USB 2.0
 +
*SD/SDHC
 +
 
 +
== Board scans ==
 +
[[File:Wii_hw_diagram.png|thumb|right|Wii hardware diagram]]
 +
Some hi-resolution board scans by bushing:
 +
* Top side of main board: [http://www.flickr.com/photos/bushing/4002792703/in/set-72157622251043764/ 600dpi] [http://www.flickr.com/photos/bushing/4002786841/in/set-72157622251043764/ 1200dpi]
 +
* Bottom side of main board: [http://www.flickr.com/photos/bushing/4003561674/in/set-72157622251043764/ 1200dpi]
 +
* Overlays: [http://www.flickr.com/photos/bushing/4002815415/in/set-72157622251043764/ Top over bottom] [http://www.flickr.com/photos/bushing/4003569106/in/set-72157622251043764/ Bottom over top]
 +
 
 +
{{Navbox hardware}}
  
 
[[Category:Hardware]]
 
[[Category:Hardware]]
 
{{Languages|Wii Hardware}}
 

Latest revision as of 20:35, 12 April 2021

The Wii's hardware is one of the most well-understood of any home console. Due to extensive research in the homebrew community, the Wii's inner workings have been reverse-engineered and have been exploited heavily in the usage of homebrew.

Introduction

Processors

The Wii has two processors. The main processor of the Wii's system, codenamed Broadway, which is a PowerPC processor that does the job of running executable code, and interfacing with legacy hardware, which includes every aspect of the Gamecube's system, with a few exceptions, which aree handled by the PowerPC. The Broadway is also called the PPC, because that is its architecture.

The other processor is nicknamed the Starlet chip, due to the fact that it lives inside the Hollywood graphics processor. The Starlet is an ARM processor that communicates with hardware, as well as the DVD drive. The program that handles communication between the PPC and the hardware is known as IOS.

The reason for this dual-processor layout was security. Before the Wii was homebrewable, people used Gamecube homebrew instead. However, Gamecube homebrew, because of this layout, could not access any of the Wii's hardware, as MIOS running on the ARM locked down all of the Wii's hardware so it could not be used until a reboot occurred.

NAND is the term for the Wii's internal flash memory, which is based on a NAND flash.

Bootloaders

All three bootloaders that the Wii has all run on the ARM, before the Wii's system actually boots. Due to the security, the ARM has no access to the screen at all.

boot0 is stored in ROM inside Hollywood - so it cannot easily be replaced. It is extremely simple, and its job is to check the hash of boot1 before booting into boot1.

boot1 is stored in NAND, but its hash is stored in OTP memory inside Hollywood. Like boot0 this means that boot1 cannot be modified. Its job is to initialize the RAM of the Wii, then perform a signature check of boot2. Making boot1 separate from boot2 allowed Nintendo to change the RAM of the Wii, which would then need slightly different initialization, without updating Hollywood. The OTP is programmed very late in Hollywood's production, as opposed to the ROM which is tightly ingrained into the chip.

boot2 is stored in NAND, as is its signature. It is a stripped down IOS. This is therefore responsible for initializing some of the Wii's hardware. It reads the System Menu's TMD to find out what IOS it uses and requires, before booting into the IOS required by the system menu.

IOS

The Wii has several operating systems which act independently. These operating systems are known as IOSes. IOS is the software that controls communications between the PPC and the Wii's hardware, via on the ARM. To aid in backwards-compatibility, each IOS has its own version number and be stored alongside all the other IOSes on the system. This means when new elements are implemented into IOS, each game can still have just the IOS that it originally had. Each game, channel and System Menu chooses which IOS to run. If it detects that the IOS it requires is not installed, the Wii alerts the user to perform a system update. This in practice is impossible without homebrew, as the system menu forces installation of updates from disc-based games before they can be played, and The Wii Shop Channel cannot be accessed without the latest update normally. This has disadvantages that were targetted by homebrew. Because of the large amounts of IOSes on the Wii's system, if a fatal bug is discovered in all of them, it takes a long time to update, test, and deploy. Since homebrew can also reload into a different IOS version during runtime, a flaw in just one IOS can bring the entire system's security down. This also means that if somehow one IOS is expected but not installed, this can cause issues with games and channels. Including some games/channels not working, or bricking.

The Wii has many IOSes that are stubbed, some of these stubbed IOSes were previously used by the System Menu, reducing them to a non-functional stub of what they used to be.

Signature Checks

The IOS performs a signature check on any channel being attempted to be installed on the system, or boot2 when the Wii is about to be booted. The Trucha Bug is the main way to work around this signature check - it has been exploited in the past for many things, and is exploited mainly to install BootMii under boot2.

Nintendo Wii Hardware Summary

  • CPU: IBM PowerPC 729 MHz
  • GPU: ATI graphics 243 MHz
    • 3 MB embedded memory
  • NEC ARM9 243 MHz
  • 512 MB Internal Flash Memory (NAND)
  • 88 MB Main Memory
    • 24 MB "internal" 1T-SRAM
    • 64 MB "external" GDDR3 SDRAM
  • 12 cm optical drive
  • Wi-Fi 802.11b/g
    • Mitsumi DWM-W004
  • Bluetooth
  • 2x USB 2.0
  • SD/SDHC

Board scans

Wii hardware diagram

Some hi-resolution board scans by bushing:

edit  

Wii hardware