The Wii U GamePad is a fairly complicated piece of hardware, containing several important and sometimes custom ICs (including 3 CPUs).
This is the main chip that runs the GamePad firmware. It is also referred to as “the ARM9” or “the LVC” in this documentation (LVC is the name of the firmware unit ran by DRC-WUP).
This SoC is based on an ARM926EJ-S CPU and seems to be custom made for this device. It presents no external markings that would allow identification of a designed/manufacturer, but it is assumed to have been designed by MegaChips Corporation. The hardware H.264 decoder present inside seems to also be of a custom design.
It is connected directly to some components via I2C and GPIOs, but it relies a lot on the UIC, which it communicates with over a SPI bus.
It is assumed to contain a very simple boot ROM that reads a secondary bootloader (SPL) from the Flash. The Boot process section goes more in details about this.
A Broadcom Wi-Fi chip that is not so custom - it was actually used in a few other products, including the Boxee TV box. The firmware running on it is a fairly standard Broadcom SDIO chip firmware with very slight alterations from Nintendo. The Wi-Fi Peculiarities section explains these changes.
It is capable of 802.11n on 5GHz frequency bands, which is the requirement to communicate with a Wii U console.
The firmware on this Broadcom chip runs on a Cortex-M3 CPU, which is amusingly more recent than the ARM926EJ-S running the main firmware.
A small embedded chip based on an STM8 CPU. It runs its own firmware loaded from an on-chip EEPROM (upgradable). Its main role is to communicate with all the input devices (buttons, analog sticks, as well as the more complicated ICs like compass, accelerometer, gyroscope and touchscreen controller) and with the Power Management IC (PMIC) that handles power control on the board (battery charge, as well as status LEDs).
It communicates with the LVC over a SPI bus (on which it is slave). A simple request-reply protocol is used to perform several actions.
The UIC also has the weird function of storing some of the configuration settings in a 2KB EEPROM. A description of the settings stored in that EEPROM can be found in the `Settings EEPROM structure`_ section.
The most important part of the Wii U GamePad firmware is the LVC_ part, which contains the code running on the ARM9 CPU. This firmware is based on the eForce operating system, a real time operating system following the µITRON 4.0 specification.
The ASSERT macros used throughout the LVC firmware code also references the source file names, giving a good idea of the structure of the firmware code and how it was made. There are 4 main parts in the LVC firmware:
Handle communication with the hardware as well as internal synchronization and callback mechanisms. The following drivers are present in the latest version of the Wii U GamePad firmware:
Network related processes that are either servers or clients and handle protocol related work: crafting and decoding packet, validating data, then passing it further down the stack to a manager that will handle the request if needed. The following services are present in the latest version of the Wii U GamePad firmware:
Background processes often getting data from either drivers or services. They keep track of state and handle most of the work that is not done in drivers. The following managers are present in the latest version of the Wii U GamePad firmware: