112
edits
Changes
Jump to navigation
Jump to search
no edit summary
Line 1:
Line 1:
{{Stub}}
−
+
+
+
+
+
+
+
{{lowercase title}}
{{lowercase title}}
−'''cafe2wii''' is the process in [[IOSU]] used to transition to [[WiiMode]]. It shuts down IOSU, lowers the [[Hardware/Espresso|Espresso]]'s clock speed, disables [[Hardware/Starbuck|Starbuck]] access to Wii U-exclusive hardware, then launches [https://wiibrew.org/wiki/IOS80 IOS80].
+'''cafe2wii''' is the process used to transition to [[WiiMode]].
+== Booting into Wii mode ==
+After being launched, cafe2wii will parse a boot info structure located at 0x00001000. It will copy all the boot info binaries to several memory locations.<br>
+The c2w.img from OSv1 version additionally verifies the header of the "hai params" located at 0x00402000 and copies them to 0xfffff000. <br>
+It then lowers the [[Hardware/Espresso|Espresso]]'s clock speed, disables [[Hardware/Starbuck|Starbuck]] access to Wii U-exclusive hardware, then directly jumps to the loaded IOS (?).
+=== C2WBin ===
+{| class="wikitable"
+|-
+! Start
+! Length
+! Description
+|-
+| 0x00
+| 4
+| size
+|-
+| 0x04
+| 4
+| paddr
+|}
+=== C2WBootInfo ===
+{| class="wikitable"
+|-
+! Start
+! Length
+! Description
+|-
+| 0x00
+| 4
+| iosVer (lowest 2 bytes of the title id and title version)
+|-
+| 0x04
+| 8 (C2WBin)
+| eeprom
+|-
+| 0x0C
+| 8 (C2WBin)
+| romfont
+|-
+| 0x14
+| 8 (C2WBin)
+| ios
+|-
+| 0x1C
+| 8 (C2WBin)
+| boot
+|-
+| 0x24
+| 8 (C2WBin)
+| app
+|}
+== Launching cafe2wii ==
+cafe2wii is launched by the MCP module of the IOSU.
+MCP-CMPT will load multiple binaries from OSv0/v1 into MEM1.
+It then launches the c2w.img, which prepares those binaries in memory.<br>
+There are 3 different launch modes for booting into vWii: "NORMAL", "SIMPLE_DOL" and "HAI". All launch modes load the OSv0/v1 c2w.img and font.bin and read the Wii EEPROM using the "/dev/crpyto" ioctl 0x1e.
+=== NORMAL (0) ===
+This mode uses the c2w.img and font.bin from [[OSv0]].<br>
+It reads and parses the TMD of the vWii System Menu stored in the SLCCMPT. Using the boot index of the TMD it loads the System Menu Ancast image into memory.<br>
+It also reads the TMD of the IOS specified by the System Menu and loads its boot content into memory.
+=== SIMPLE_DOL (1) ===
+This mode also uses the c2w.img and font.bin from [[OSv0]].<br>
+It then tries to load a fw.img, boot.bin and app.dol from OSv0. This might have been a feature used for testing during development, since these files are no longer part of OSv0.
+=== HAI (2) ===
+This mode uses the c2w.img and font.bin from [[OSv1]].<br>
+It loads the [[COMPAT-BS]] Ancast image (boot.bin) from OSv1 into memory and an IOS named fw.img from the launched title (this is usually [[HAI-IOS]]).<br>
+It also prepares a structure with hai parameters in memory. Those parameters will be parsed by the loaded IOS.