Difference between revisions of "Hardware"

From WiiBrew
Jump to navigation Jump to search
m (Added the hardware navbox)
 
(20 intermediate revisions by 10 users not shown)
Line 1: Line 1:
{{Main page box|Wii hardware|Hardware}}
+
The [[Wii]]'s hardware is one of the most well-understood of any home console. Due to extensive research in the homebrew community, the Wii's inner workings have been reverse-engineered and have been exploited heavily in the usage of homebrew.
<div style="margin: -.3em -1em -1em -1em;">
 
{| width="100%" bgcolor="#fff" border="0" cellpadding="3px" cellspacing="2px" style="margin:auto;"
 
|- align="center" bgcolor="#E6F2FF"
 
! width="25%" | '''[[Hardware/Starlet|Starlet]]'''
 
! width="25%" | '''[[Hardware/Broadway|Broadway]]'''
 
! width="25%" | '''Common'''
 
! width="25%" | '''Other'''
 
  
|- valign="top" align="left" style="background: #F5FAFF; font-size: 92%;"
+
== Introduction ==
|
+
 
*[[Hardware/Hollywood Registers|Hollywood Registers]]
+
=== Processors ===
**[[Hardware/OTP|OTP ROM]]
+
The Wii has two processors. The main processor of the Wii's system, codenamed Broadway, which is a PowerPC processor that does the job of running executable code, and interfacing with legacy hardware, which includes every aspect of the Gamecube's system, with a few exceptions, which aree handled by the PowerPC. The Broadway is also called the PPC, because that is its architecture.
**[[Hardware/Starlet Timer|Starlet Timer]]
+
 
*[[Hardware/NAND Interface|NAND Interface]]
+
The other processor is nicknamed the Starlet chip, due to the fact that it lives inside the Hollywood graphics processor. The Starlet is an ARM processor that communicates with hardware, as well as the DVD drive. The program that handles communication between the PPC and the hardware is known as [[IOS]].
*[[Hardware/AES Engine|AES Engine]]
+
 
*[[Hardware/SHA-1 Engine|SHA-1 Engine]]
+
The reason for this dual-processor layout was security. Before the Wii was homebrewable, people used Gamecube homebrew instead. However, Gamecube homebrew, because of this layout, could not access any of the Wii's hardware, as [[MIOS]] running on the ARM locked down all of the Wii's hardware so it could not be used until a reboot occurred.
*[[Hardware/USB Host Controller|USB Host Controller]]
+
 
*[[Hardware/SD Host Controller|SD Host Controller]]
+
[[NAND]] is the term for the Wii's internal flash memory, which is based on a NAND flash.
*[[Hardware/802.11 Wireless|802.11 Wireless]]
+
 
|
+
=== Bootloaders ===
*[[Hardware/GX|GX GPU]]
+
All three bootloaders that the Wii has all run on the ARM, before the Wii's system actually boots. Due to the security, the ARM has no access to the screen at all.
*[[Hardware/Video Interface|Video Interface]]
+
 
*[[Hardware/Processor Interface|Processor Interface]]
+
[[boot0]] is stored in ROM inside Hollywood - so it cannot easily be replaced. It is extremely simple, and its job is to check the hash of [[boot1]] before booting into boot1.
*[[Hardware/Memory Interface|Memory Interface]]
+
 
*[[Hardware/DSP|Audio DSP]]
+
boot1 is stored in NAND, but its hash is stored in OTP memory inside Hollywood. Like boot0 this means that boot1 cannot be modified. Its job is to initialize the RAM of the Wii, then perform a signature check of boot2. Making boot1 separate from boot2 allowed Nintendo to change the RAM of the Wii, which would then need slightly different initialization, without updating Hollywood. The OTP is programmed very late in Hollywood's production, as opposed to the ROM which is tightly ingrained into the chip.
|
+
 
*[[Hardware/Main Memory|Main Memory]]
+
[[boot2]] is stored in NAND, as is its signature. It is a stripped down IOS. This is therefore responsible for initializing some of the Wii's hardware. It reads the System Menu's TMD to find out what IOS it uses and requires, before booting into the IOS required by the system menu.
*[[Hardware/Hollywood Registers|Hollywood Registers]]
+
 
**[[Hardware/IPC|Inter-processor Communication]]
+
=== IOS ===
**[[Hardware/Hollywood GPIOs|Hollywood GPIOs]]
+
The Wii has several operating systems which act independently. These operating systems are known as [[IOS]]es. IOS is the software that controls communications between the PPC and the Wii's hardware, via on the ARM. To aid in backwards-compatibility, each IOS has its own version number and be stored alongside all the other IOSes on the system. This means when new elements are implemented into IOS, each game can still have just the IOS that it originally had. Each game, channel and System Menu chooses which IOS to run. If it detects that the IOS it requires is not installed, the Wii alerts the user to perform a system update. This in practice is impossible without homebrew, as the system menu forces installation of updates from disc-based games before they can be played, and The Wii Shop Channel cannot be accessed without the latest update normally. This has disadvantages that were targetted by homebrew. Because of the large amounts of IOSes on the Wii's system, if a fatal bug is discovered in all of them, it takes a long time to update, test, and deploy. Since homebrew can also reload into a different IOS version during runtime, a flaw in just one IOS can bring the entire system's security down. This also means that if somehow one IOS is expected but not installed, this can cause issues with games and channels. Including some games/channels not working, or bricking.
**[[Hardware/Hollywood IRQs|Hollywood IRQs]]
+
 
*[[Hardware/Drive Interface|Drive Interface]]
+
The Wii has many IOSes that are stubbed, some of these stubbed IOSes were previously used by the System Menu, reducing them to a non-functional stub of what they used to be.
*[[Hardware/Serial Interface|Serial Interface]]
+
 
*[[Hardware/External Interface|External Interface]]
+
==== Signature Checks ====
*[[Hardware/Audio Interface|Audio Interface]]
+
The IOS performs a signature check on any channel being attempted to be installed on the system, or boot2 when the Wii is about to be booted. The Trucha Bug is the main way to work around this signature check - it has been exploited in the past for many things, and is exploited mainly to install [[BootMii]] under boot2.
|
+
 
*[[Hardware/Bluetooth Card|Bluetooth Card]]
+
== Nintendo Wii Hardware Summary ==
*[[Hardware/SEEPROM|Serial EEPROM]]
+
*'''CPU:''' IBM PowerPC '''729 MHz'''
*[[Hardware/NAND|NAND Flash]]
+
*'''GPU:''' ATI graphics '''243 MHz'''
*[[Hardware/RTC-SRAM-ROM|RTC/SRAM/Font ROM]]
+
**3 MB embedded memory
*[[Hardware/Disc Drive|Disc Drive]]
+
*NEC ARM9 '''243 MHz'''
*[[Hardware/AV_Encoder|A/V Encoder]]
+
*'''512 MB''' Internal Flash Memory (NAND)
|}
+
*'''88 MB''' Main Memory
</div>
+
**24 MB "internal" 1T-SRAM
{{box-footer-empty}}
+
**64 MB "external" GDDR3 SDRAM
 +
*12 cm optical drive
 +
*Wi-Fi  '''802.11b/g'''
 +
**Mitsumi DWM-W004
 +
*Bluetooth
 +
*2x USB 2.0
 +
*SD/SDHC
  
 
== Board scans ==
 
== Board scans ==
[[Image:Wii_hw_diagram.png|thumb|right|Wii hardware diagram (somewhat outdated/incorrect)]]
+
[[File:Wii_hw_diagram.png|thumb|right|Wii hardware diagram]]
 
Some hi-resolution board scans by bushing:
 
Some hi-resolution board scans by bushing:
* Top side of main board: [http://farm2.static.flickr.com/1287/986598465_a50c7db22b_o.jpg 600dpi] [http://farm2.static.flickr.com/1235/986668759_0fdc200042_o.jpg 1200dpi]
+
* Top side of main board: [http://www.flickr.com/photos/bushing/4002792703/in/set-72157622251043764/ 600dpi] [http://www.flickr.com/photos/bushing/4002786841/in/set-72157622251043764/ 1200dpi]
* Bottom side of main board: [http://farm2.static.flickr.com/1226/1048420991_f4c60b8d7d_o.jpg 1200dpi]
+
* Bottom side of main board: [http://www.flickr.com/photos/bushing/4003561674/in/set-72157622251043764/ 1200dpi]
* Overlays: [http://farm2.static.flickr.com/1312/1048073907_ab5b1446c9_o_d.jpg Top over bottom] [http://farm2.static.flickr.com/1018/1049070720_22ac0ef571_o_d.jpg Bottom over top]
+
* Overlays: [http://www.flickr.com/photos/bushing/4002815415/in/set-72157622251043764/ Top over bottom] [http://www.flickr.com/photos/bushing/4003569106/in/set-72157622251043764/ Bottom over top]
 +
 
 +
{{Navbox hardware}}
  
 
[[Category:Hardware]]
 
[[Category:Hardware]]

Latest revision as of 20:35, 12 April 2021

The Wii's hardware is one of the most well-understood of any home console. Due to extensive research in the homebrew community, the Wii's inner workings have been reverse-engineered and have been exploited heavily in the usage of homebrew.

Introduction

Processors

The Wii has two processors. The main processor of the Wii's system, codenamed Broadway, which is a PowerPC processor that does the job of running executable code, and interfacing with legacy hardware, which includes every aspect of the Gamecube's system, with a few exceptions, which aree handled by the PowerPC. The Broadway is also called the PPC, because that is its architecture.

The other processor is nicknamed the Starlet chip, due to the fact that it lives inside the Hollywood graphics processor. The Starlet is an ARM processor that communicates with hardware, as well as the DVD drive. The program that handles communication between the PPC and the hardware is known as IOS.

The reason for this dual-processor layout was security. Before the Wii was homebrewable, people used Gamecube homebrew instead. However, Gamecube homebrew, because of this layout, could not access any of the Wii's hardware, as MIOS running on the ARM locked down all of the Wii's hardware so it could not be used until a reboot occurred.

NAND is the term for the Wii's internal flash memory, which is based on a NAND flash.

Bootloaders

All three bootloaders that the Wii has all run on the ARM, before the Wii's system actually boots. Due to the security, the ARM has no access to the screen at all.

boot0 is stored in ROM inside Hollywood - so it cannot easily be replaced. It is extremely simple, and its job is to check the hash of boot1 before booting into boot1.

boot1 is stored in NAND, but its hash is stored in OTP memory inside Hollywood. Like boot0 this means that boot1 cannot be modified. Its job is to initialize the RAM of the Wii, then perform a signature check of boot2. Making boot1 separate from boot2 allowed Nintendo to change the RAM of the Wii, which would then need slightly different initialization, without updating Hollywood. The OTP is programmed very late in Hollywood's production, as opposed to the ROM which is tightly ingrained into the chip.

boot2 is stored in NAND, as is its signature. It is a stripped down IOS. This is therefore responsible for initializing some of the Wii's hardware. It reads the System Menu's TMD to find out what IOS it uses and requires, before booting into the IOS required by the system menu.

IOS

The Wii has several operating systems which act independently. These operating systems are known as IOSes. IOS is the software that controls communications between the PPC and the Wii's hardware, via on the ARM. To aid in backwards-compatibility, each IOS has its own version number and be stored alongside all the other IOSes on the system. This means when new elements are implemented into IOS, each game can still have just the IOS that it originally had. Each game, channel and System Menu chooses which IOS to run. If it detects that the IOS it requires is not installed, the Wii alerts the user to perform a system update. This in practice is impossible without homebrew, as the system menu forces installation of updates from disc-based games before they can be played, and The Wii Shop Channel cannot be accessed without the latest update normally. This has disadvantages that were targetted by homebrew. Because of the large amounts of IOSes on the Wii's system, if a fatal bug is discovered in all of them, it takes a long time to update, test, and deploy. Since homebrew can also reload into a different IOS version during runtime, a flaw in just one IOS can bring the entire system's security down. This also means that if somehow one IOS is expected but not installed, this can cause issues with games and channels. Including some games/channels not working, or bricking.

The Wii has many IOSes that are stubbed, some of these stubbed IOSes were previously used by the System Menu, reducing them to a non-functional stub of what they used to be.

Signature Checks

The IOS performs a signature check on any channel being attempted to be installed on the system, or boot2 when the Wii is about to be booted. The Trucha Bug is the main way to work around this signature check - it has been exploited in the past for many things, and is exploited mainly to install BootMii under boot2.

Nintendo Wii Hardware Summary

  • CPU: IBM PowerPC 729 MHz
  • GPU: ATI graphics 243 MHz
    • 3 MB embedded memory
  • NEC ARM9 243 MHz
  • 512 MB Internal Flash Memory (NAND)
  • 88 MB Main Memory
    • 24 MB "internal" 1T-SRAM
    • 64 MB "external" GDDR3 SDRAM
  • 12 cm optical drive
  • Wi-Fi 802.11b/g
    • Mitsumi DWM-W004
  • Bluetooth
  • 2x USB 2.0
  • SD/SDHC

Board scans

Wii hardware diagram

Some hi-resolution board scans by bushing:

edit  

Wii hardware