IOS
IOSU is the operating system running on the ARM in Wii U mode. It is the Wii U equivalent of IOS on the Wii, and similar in some regards, but it is a complete rewrite with many changes. IOSU implements the Wii U's security policy, which includes titles and hardware access. One of its primary responsibilities is enforcing code signing, verifying all titles before installation and launch. Another one of its jobs is managing access to most hardware, such as storage, network, USB, and the Gamepad. The PowerPC can talk to IOSU through an IPC interface, and make security and hardware requests.
See Also
Architecture
IOSU is an embedded operating system written by Nintendo, with a microkernel architecture. It contains a simple kernel that implements memory management and process and thread management. Device drivers and security handlers run as processes in the ARM user mode. These processes, called resource managers (RMs), can register as request handlers for resources, which are represented as nodes under /dev in a virtual filesystem. They communicate with each other through the kernel, using standard Unix file operations (open/close/read/write/seek/ioctl/ioctlv).
IPC
PowerPC code is able to call IOSU drivers through an IPC interface. It uses the same call interface as IOSU does internally. Userspace code submits IOSU requests with the IPCKDriver_SubmitRequest() syscall in the Cafe OS kernel. The kernel includes information to identify which Cafe OS process sent the request, allowing IOSU to check permissions on a per-app basis. Requests are contained in a struct, sent to a memory area, and marshalled by a special IOSU process that makes syscalls on behalf of the PowerPC.
ipc struct size = 0x48, aligned to 0x20 0x00: cmd // 1=open, 2=close, 3=read, 4=write, 5=seek, 6=ioctl, 7=ioctlv 0x04: UNKNOWN (return value?) 0x08: fd 0x0C: UNKNOWN (always 0?) 0x10: CPU number (0 = ARM?, 1-3 = CPU0-2) 0x14: RAMPID 0x18: title_id 0x20: UNKNOWN 0x24: args[5] (after virtual->physical translation) 0x38: cmd (copy) 0x3C: fd (copy) 0x40: virts[2]
Modules
Security
- /dev/mcp - Title launching (similar to ES on Wii?)
- /dev/crypto - Cryptographic services?
Filesystem
- /dev/fsa - Virtual filesystem API
- /dev/isfs - Internal storage FS
- /dev/atfs - Optical disc FS
- /dev/fat - SD card FS
- /dev/wfs - Wii U external drive FS?
- /dev/pcfs - Devkit PC FS?
- /dev/rbfs
- /dev/fla
- /dev/ahcimgr
- /dev/shdd
- /dev/md
- /dev/scfm
- /dev/mmc
- /dev/ums
- /dev/timetrace
Network
Network hardware and socket API
- /dev/network
- /dev/wl0 - Wireless adapter driver
- /dev/usbeth - USB Ethernet driver
- /dev/net/ifmgr
- /dev/net/ifmgr/wd
- /dev/net/ifmgr/ncl - Network configuration
- /dev/ifnet
- /dev/socket - BSD sockets API
- /dev/wifi24 - Standby mode?
- /dev/wifidata
- /dev/nsec/nssl - SSL API
USB
Low-level and peripheral access
- /dev/uhs - Low-level API
- /dev/usb_hid - USB HID driver
- /dev/usb/btrm - Bluetooth module (for Wii Remote and Pro Controller)
DRH
Wii U communication with the Gamepad
- /dev/ccr_cdc - RPC (CDC = Communications Device Class)
- /dev/ccr_hid - Input (HID = Human Interface Device)
- /dev/ccr_uvc - Camera (UVC = USB Video Class)
- /dev/ccr_uac - Microphone (UAC = USB Audio Class)
- /dev/ccr_nfc - NFC reader
Virtual Memory Map
- 0x04000000 - 0x04030000 IOS-CRYPTO
- 0x05000000 - 0x050C0000 IOS-MCP
- 0x05100000 - 0x05120000 Unknown
- 0x08120000 - 0x081C0000 IOS-KERNEL
- 0x10000000 - 0x10100000 Unknown
- 0x10100000 - 0x104D0000 IOS-USB
- 0x10800000 - 0x11EE0000 IOS-FS
- 0x11F00000 - 0x12160000 IOS-PAD
- 0x12300000 - 0x12890000 IOS-NET
- 0x1D000000 - 0x1FB00000 Global heap
- 0x1FB00000 - 0x1FE00000 Global IOB (input/output block)
- 0x1FE00000 - 0x1FE20000 Unknown
- 0x1FE40000 - 0x20000000 Unknown
- 0x20000000 - 0x28000000 Unknown
- 0xE0000000 - 0xE0270000 IOS-ACP
- 0xE1000000 - 0xE12F0000 IOS-NSEC
- 0xE2000000 - 0xE26D0000 IOS-NIM-BOSS
- 0xE3000000 - 0xE3300000 IOS-FPD
- 0xE4000000 - 0xE4160000 IOS-TEST
- 0xE5000000 - 0xE5070000 IOS-AUXIL
- 0xE6000000 - 0xE6050000 IOS-BSP
- 0xE7000000 - 0xE7001000 Unknown
- 0xEFF00000 - 0xEFF08000 Unknown
- 0xFFFF0000 - 0xFFFFFFFF Kernel SRAM