Hardware/Disc Drive

From WiiBrew
Jump to navigation Jump to search
The disc drive.

The disc drive is a component in the Wii. It is designed to read DVDs in specific, unlike a wide variety of DVD drives, the Wii's drive does not support CDs. The drive has a locking mechanism in the center, which pulls down when a disc is inserted. There are also latching mechanisms, which pull back for Wii discs, and stay in place for holding GameCube discs.

Maintenance

The Wii disc drive is the most likely component to fail in the Wii due to aging and moving parts. Inside the disc drive, the most likely component to fail or to wither in performance is the lens.

If the disc drive is incapable of reading discs well, it is recommended to clean the lens. This can be done by using a q-tip and isopropyl alcohol, and gently cleaning the lens using the q-tip. Gentle means gentle, so it is not recommended to go any harder then it should be.

Dust buildup can happen at the rod section inside the drive, which can be cleaned out with a q-tip.

Assuming that the disc drive needs to be totally replaced, there are about three or four screws (depends on model) holding in the drive. After removing these screws, unplug the disc drive and gently remove the ribbon cable.

Hardware

The MN102 chip accessed via Hardware/DI is backwards compatible with the one on the GameCube, but has additional commands; see /dev/di for examples. The password used to unlock debug mode was changed from "MATSHITA DVD-GAME" to "matshita dvd-game".[1] It also seems to be impossible to send that password from code running on the Wii, but perhaps is possible to directly send it over the ribbon cable.[check]

MN102 Serial Writer

This is the interface used by 9 & 6 wire mod chips to patch the drives firmware.

It looks as though Matsushita tried to disable this interface in the D2C and newer drive controllers. A clock glitch allowed mod chip vendors to defeat this protection and use the "Serial Writer" to inject firmware.

Here is a description of the "Serial Writer" protocol commands used by most modchips. The modchip sends commands (and optionally data) to the drive controller which responds with its status

Command Packet Format

XX,YY,YY,YY,YY,YY,YY,YY,YY,YY,YY,CC

Where

XX is the Command

YY is 10 bytes of data

CC is the 8 bit checksum (add first 11 bytes modulo 256)

Response

Command Byte OR'ed with result

01 = OK 02 = Bad Checksum 04 = Failed

Commands

Complete list is 10,20,30,40,50,60,70,90

20 SecretKey Send Secret Key to unlock drive. This is the first command to be sent and enables all the others. The Secret Key is located at 0x80800 in the DVD controllers memory, if it is set to FFFFFFFFFFFFFFFF in the DVD controllers memory then no check is made

20, KK, KK, KK, KK, KK, KK, KK, KK, 00, 00, CC

KK is 8 bytes of secret key CC is the 8 bit checksum

Response: 2X

30 Download Data Downloads data to the DVD controller's RAM

30, 00, PP, PP, PP, LL, LL, 00, 00, 00, 00, CC

PP is a 24 bit ptr (MSB first) LL is 1 16 bit length (MSB first) CC is the 8 bit checksum

Response: 3X

The DVD controller then expects to receive length bytes of data followed by an eight bit checksum

[Length bytes], CC

Response: 3X

NOTE: It is not important if the second checksum (for the data) since it has been downloaded to RAM anyway, seems ARGON/D2Pro uses checksum = 0

40 Execute Downloaded Data This always follows a 30 command and causes the DVD controller to jump to the download address

40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, CC

CC is the 8 bit checksum

Response: 4X

70 Upload Data Uploads data from the DVD controller's memory

70, 00, PP, PP, PP, LL, LL, 00, 00, 00, 00, CC

PP is a 24 bit ptr (MSB first) LL is a 16 bit length (MSB first) CC is the 8 bit checksum

Response: 7X

The DVD controller then sends length bytes of data from ptr followed by an eight bit checksum

[Length bytes], CC

Physical interface

The disk drive is connected to the motherboard via 2 cables, a power and a data cable.

Power cable

Power is delivered via a 12-pin Molex connector with the following pinout:

Pinout of the power connector on the daughterboard
Pin Name
1 GND
2 GND
3 3.3V
4 3.3V
5 GND
6 GND
7 5V
8 5V
9 GND
10 GND
11 12V
12 12V

Data cable

The 32 pin ribbon cable used to connect the disk drive to the motherboard seems to be very similar to the Gamecube, but with the order flipped a few rearranged. The overall design seems to draw heavily from parallel ports.[2][3]

Pin Name Description
1 DID0
2 GND
3 DID1
4 GND
5 DID2
6 GND
7 DID3
8 GND
9 DID4
10 GND
11 DID5
12 GND
13 DID6
14 GND
15 DID7
16 GND
17 DIDSTRB Drive IF device strobe
18 GND
19 DIHSTRB Drive IF host strobe
20 GND
21 DIDIR Drive IF direction
22 DIRSTB Drive IF reset bit
23 DICOVER Drive IF cover
24 DIBRK Drive IF break
25 DIERRB Drive IF error bit
26 AISCLK Audio IF serial clock
27 AISDATA Audio IF serial data
28 AISLR Audio IF serial left/right
29 DISC_EJECT
30 DOOR_SNSR (NC)
31 Unknown (NC)
32 SENSE_PWR 3.3V
Transactions strobe DIHSTRB first, then send a 12-byte transaction as described above. STRB lines are latched on rising edge

On power-up the Wii will set DRSTB, which starts the DVD processor working. The DVD drive should be reading from DID[0:7] in Input mode, and it should also monitor DIHSTRB and DIDIR. (Any time the Wii raises DIDIR, it wants the DVD to run the data bus. Any time it drops to Low, the DVD should stop what it's sending, and flip from output to input).

On the GameCube, the host will transmit at 20 MHz while the drive will respond at 13.5 MHz.

Audio Streaming

Audio is streamed serially over AISD driven by AISCLK. AISLR signals whether the audio word is left or right.

The DVD drive has a built-in ability to decode regions of ADPCM sound. These are sent back on special pins which route to the sound processor. Thus, the CPU is freed from having to decode audio itself: it merely issues start/stop/queue commands and lets the drive do all the heavy lifting. In order for this to work properly, a few things are needed:

  • DVD drive has to be able to decode the ADPCM sound and send it back on the Audio pins 26-28
  • Audio data must be aligned on 32kB sectors on disk, because the seek command is only this granular. Get the alignment wrong and only static will play.

Data is 16-bit big-endian stereo PCM. The clock is host-controlled and can be 32-48 kHz, effectively i2s.

Example

Modchips do the following with my D2C drive:

1) Send SecretKey 20 2BFCDE02F3FECA60 0000 42

2) Read 1 byte from memory location 0x08838E (I am guessing, drive type?) 70 40 08838E 0001 838E0000 DB 71 DF DF (1st DF is data byte, 2nd DF is checksum)

3) Writes 0x49 bytes to 0x008032 30 00 008032 0049 00000000 2B 31

4) Executes the code at 0x008032 (& maybe resets drive) 40 00000000000000000000 40 41

5) Send SecretKey 20 2BFCDE02F3FECA60 0000 42

6) Download 0x1312 bytes to 0x40C000 30 00 40C000 1312 00000000 55 31

7) Executes the code at 0x40C000 40 00000000000000000000 40 41

References

1. See tmbinc's Console Hacking 2006 presentation at CCC for more information.
2. "Using a Wii drive replacement on a GameCube". https://www.gc-forever.com/wiki/index.php?title=Using_a_Wii_drive_replacement_on_a_GameCube. 
3. hornpipe2. "The Definitive DI / DVD Interface Thread". https://www.gc-forever.com/forums/viewtopic.php?t=3362.