IOS

IOSU is the operating system running on the ARM in Wii U mode. It is the Wii U equivalent of IOS on the Wii, and similar in some regards, but it is a complete rewrite with many changes. IOSU implements the Wii U's security policy, which includes titles and hardware access. One of its primary responsibilities is enforcing code signing, verifying all titles before installation and launch. Another one of its jobs is managing access to most hardware, such as storage, network, USB, and the Gamepad. The PowerPC can talk to IOSU through an IPC interface, and make security and hardware requests.

See Also

• IOSU Syscalls

Architecture

IOSU is an embedded operating system written by Nintendo, with a microkernel architecture. It contains a simple kernel that implements memory management and process and thread management. Device drivers and security handlers run as processes in the ARM user mode. These processes, called resource managers (RMs), can register as request handlers for resources, which are represented as nodes under /dev in a virtual filesystem. They communicate with each other through the kernel, using standard Unix file operations (open/close/read/write/seek/ioctl/ioctlv).

IPC

PowerPC code is able to call IOSU drivers through an IPC interface. It uses the same call interface as IOSU does internally. Userspace code submits IOSU requests with the IPCKDriver_SubmitRequest() syscall in the Cafe OS kernel. The kernel includes information to identify which Cafe OS process sent the request, allowing IOSU to check permissions on a per-app basis. Requests are contained in a struct, sent to a memory area, and marshalled by a special IOSU process that makes syscalls on behalf of the PowerPC.

ipc struct size = 0x48, aligned to 0x20

0x00: cmd    // 1=open, 2=close, 3=read, 4=write, 5=seek, 6=ioctl, 7=ioctlv
0x04: UNKNOWN (return value?)
0x08: fd
0x0C: UNKNOWN (always 0?)
0x10: CPU number (0 = ARM?, 1-3 = CPU0-2)
0x14: RAMPID
0x18: title_id
0x20: UNKNOWN
0x24: args[5] (after virtual->physical translation)
0x38: cmd (copy)
0x3C: fd (copy)
0x40: virts[2]

Modules

Security

• /dev/mcp - Title launching (similar to ES on Wii?)
• /dev/crypto - Cryptographic services?

Filesystem

• /dev/fsa - Filesystem API?

Network

Network hardware and socket API

• /dev/network - Network settings?
• /dev/wifi24 - Standby mode?
• /dev/usbeth - USB Ethernet driver
• /dev/ifmgr
• /dev/ifnet
• /dev/socket - BSD sockets API

USB

Low-level and peripheral access

• /dev/uhs - Low-level API
• /dev/usb_hid - USB HID driver
• /dev/usb/btrm - Bluetooth module (for Wii Remote and Pro Controller)

DRH

Wii U communication with the Gamepad

• /dev/ccr_cdc - RPC (CDC = Communications Device Class)
• /dev/ccr_hid - Input (HID = Human Interface Device)
• /dev/ccr_uvc - Camera (UVC = USB Video Class)
• /dev/ccr_uac - Microphone (UAC = USB Audio Class)
• /dev/ccr_nfc - NFC reader

Virtual Memory Map

• 0x04000000 - 0x04030000 IOS-CRYPTO
• 0x05000000 - 0x050C0000 IOS-MCP
• 0x05100000 - 0x05120000 Unknown
• 0x08120000 - 0x081C0000 IOS-KERNEL
• 0x10000000 - 0x10100000 Unknown
• 0x10100000 - 0x104D0000 IOS-USB
• 0x10800000 - 0x11EE0000 IOS-FS
• 0x11F00000 - 0x12160000 IOS-PAD
• 0x12300000 - 0x12890000 IOS-NET
• 0x1D000000 - 0x1FB00000 Global heap
• 0x1FB00000 - 0x1FE00000 Global IOB (input/output block)
• 0x1FE00000 - 0x1FE20000 Unknown
• 0x1FE40000 - 0x20000000 Unknown
• 0x20000000 - 0x28000000 Unknown
• 0xE0000000 - 0xE0270000 IOS-ACP
• 0xE1000000 - 0xE12F0000 IOS-NSEC
• 0xE2000000 - 0xE26D0000 IOS-NIM-BOSS
• 0xE3000000 - 0xE3300000 IOS-FPD
• 0xE4000000 - 0xE4160000 IOS-TEST
• 0xE5000000 - 0xE5070000 IOS-AUXIL
• 0xE6000000 - 0xE6050000 IOS-BSP
• 0xE7000000 - 0xE7001000 Unknown
• 0xEFF00000 - 0xEFF08000 Unknown
• 0xFFFF0000 - 0xFFFFFFFF Kernel SRAM