Xbox Architecture

https://www.copetti.org/projects/consoles/xbox/

by timeoperator • 6 years ago

226 73 6 years ago

transpute• 6 years ago

Xbox One architecture talk (2019): https://www.platformsecuritysummit.com/2019/speaker/chen/

Every game console since the first Atari was more or less designed to prevent the piracy of games and yet every single game console has been successfully modified to enable piracy. However, this trend has come to an end. Both the Xbox One and the PS4 have now been on the market for close to 6 years, without hackers being able to crack the system to enable piracy or cheating. This is the first time in history that game consoles have lasted this long without being cracked to enable piracy. In this talk, we will discuss how we achieved this for the Xbox One. We will first describe the Xbox security design goals and why it needs to guard against hardware attacks, followed by descriptions of the hardware and software architecture to keep the Xbox secure. This includes details about the custom SoC we built with AMD and how we addressed the fact that all data read from flash, the hard drive, and even DRAM cannot be trusted. We will also discuss the corresponding software changes we made to keep the system and the games secure.

favokus• 6 years ago

Uh, I'm confused. The PS4 has been cracked. Jailbreaks exist. And yes, they enable piracy. But like any console that is still being actively supported/updated by the manufacturer, it requires a certain firmware version (or below).

Thaxll• 6 years ago

None of the recent firmware have been cracked.

muricula• 6 years ago

Yes. The talk was given by an xbox architect, and iirc he mentions he's not sure about the state of the PS4. It's a great talk and if you're interested in security you should give it a watch.

jsheard2• 6 years ago

That's true, but Sony has been successful in making jailbreaking unfeasible for most people. The only path to a jailbroken PS4 today is to find one that's been sitting in a drawer without being updated for over 3 years, and even if you get that far there's no workaround for the version check on newer games so you can't play anything (legitimately or otherwise) that require firmware newer than the last exploitable version from 3 years ago, which rules out quite a few killer app exclusives.

Unlike past generations you can't just brute force it with hardware modifications either, the security is so deeply embedded in the SoC now that there's no way to touch it. Without a software exploit you're shit out of luck.

cortesoft• 6 years ago

Do the jailbreaks let you play online with pirated games?

vmception2• 6 years ago

Well this is false.

But I can say that I became disinterested in piracy when they made getting games more convenient than piracy. When they made using the hardware closer to its full potential part of the default experience. When they got the pricing right for these “premium” but pretty basic features. And of course, personally having the disposable income to afford the content because I would have never been a customer when I was pirating, only an unpaid evangelist of the franchise.

bluedino• 6 years ago

It’s still hard to beat “free”

jariel2• 6 years ago

"And of course, personally having the disposable income to afford the content"

I think this is most of the story.

I mean, it's fun to hack, but a lot of people's ideology about a lot of things go out the window as soon as they have a regular job and can afford to buy regular stuff and see these things as pretty much regular products and services.

numpad0• 6 years ago

Also multiplayer. One does not simply go online with pirated games! This didn’t matter to pirates when games were mostly singleplayer with local multi as a bonus.

Causality1• 6 years ago

Personally I'd call myself a "hybrid consumer." I'll pirate a game as an offline demo if the only way to purchase it doesn't allow refunds. I'll also pirate a game if I already paid for it on a different platform. There are quite a few PC games still in their plastic wrap on my shelf because they required obnoxious add-on software like uPlay and pirating something I already bought was preferable to installing it.

zerr• 6 years ago

Why bother? Those who "pirate" will never convert to paid customers so why not let kids from some landlocked African country or rural India enjoy games?

fwip• 6 years ago

A) a lot of people who do pirate in console are current customers. They spend quite a bit of money to get access to "every game ever" and stop buying new games. B) a lot of other ones hack the console in order to play hacked copies of the game in multiplayer, which ruins the experience for paying customers.

jfkebwjsbx• 6 years ago

Those who "pirate" will never convert to paid customers

That's not true. Many people won’t pay for something if they can get it for free reasonably easy.

saagarjha3• 6 years ago

I'm just looking at the motherboard layout at the very top of the article, and it's really strange to my non-expert eyes. The CPU is off to one side, and the GPU is the thing in the middle. And the SDRAM is all split up and far away from the CPU! Is this some sort of game-console specific thing?

henryfjordan• 6 years ago

It looks like the CPU and GPU are really close, which makes sense because it looks like there's a ton of pins shared between the two.

Ultimately designing a circuit board layout is an optimization problem. You usually have some constraints, like how close chips can be before they start interfering with each other magnetically, where the I/O will be, and where you need holes to mount the board. Then you either try to be a pathing optimizer yourself or you run a program that will layout your board for you.

I'm not sure about the XBox, but game consoles sometimes have faster Memory->GPU pipelines than normal PCs to speed up render times, which might be why the GPU is the most central component.

wtallis3• 6 years ago

CPUs didn't have DRAM controllers on-die back then. The GPU is performing that function for the system, and the link between the CPU and GPU is the CPU's front side bus rather than PCI(e). The CPU and GPU are also close together so they can both be cooled effectively by the same fan.

easde• 6 years ago

The architecture here is similar to old PCs (roughly before 2010) that had integrated graphics in the northbridge. The memory controller also resides in the northbridge. The CPU communicates with the northbridge through the front-side bus. Incidentally the northbridge also used to be responsible for high-speed I/O such as PCIe, so even if you had a discrete GPU it would not be connected directly to the CPU.

Over time CPUs have integrated all those features on-die, resulting in today's SoC-like processors where the "chipset" is merely an I/O expander connected over a PCIe-like link.

noisem4ker• 6 years ago

high-speed I/O such as PCIe

Back in the years we're talking about, that would be AGP (https://en.m.wikipedia.org/wiki/Accelerated_Graphics_Port).

flipacholas2• 6 years ago

That design is called Unified Memory Architecture or 'UMA' and can save a lot of production costs at the expense of greater memory latency. The Xbox is not the first one to implement it (the N64 is another good example).

phire4• 6 years ago

The xbox (like many consoles, n64, gamecube, xbox360, wii, wii u, xbox one, ps4, switch ps5, XSX) has unified memory, as in the CPU and GPU share the same sdram.

The only way to do this is to have one chip (It's always the GPU. The GPU needs more memory bandwidth) connected directly to the dram, and the second chip (CPU) has to send memory requests to the second chip.

Though, this console dates to a time when CPUs didn't typically have dram controllers onboard. PCs usually relied on a northbridge chip to have the dram controllers, along with the routing to all peripherals (PCI/AGP) and present a nice tidy Front-side-bus that the CPU understands. In the case of the xbox, the GPU is acting as a combined Northbridge/GPU (a design that was common at the time in low-cost desktops and laptops)

Unified memory has a large number of advantages for consoles. It lowers cost. It gets rid of copying delays between GPU and CPU memory and it allows the game developer to dynamically allocate memory to the GPU or CPU depending on their needs.

wtallis3• 6 years ago

In the case of the xbox, the GPU is acting as a combined Northbridge/GPU (a design that was common at the time in low-cost desktops and laptops)

As I recall, the earliest Intel integrated graphics added almost nothing to the production cost of the chipset. The die needed a certain perimeter to support all the IO connections, and that left quite a bit of unused silicon in the middle. Putting GPU logic in that space was almost free (minus R&D), and only slightly increased the total pin count. Intel got to capture slightly more revenue per PC and deny a lot of revenue to competing chip companies making discrete GPUs.

The situation today is very different, with GPU and CPU on the same die and the GPU blocks taking up far more space than the CPU cores. The integrated GPU is an important part of the chip cost, and that means desktop processors often have worse (smaller) iGPUs than laptop chips.

vvanders• 6 years ago

One notable exception from that list is the PS3. That thing was a real bastard to write for but if you managed to vectorize things properly it did really go at a good clip.

One fun thing was optimizing for the SPUs meant that your code was really cache coherent and usually saw significant gains on all platforms. Of course most people at that time wrote for PC+360 first and entered a world of pain when PS3 came along.

If there's one lesson to take away it's always build for your most constrained platforms first. There's still a few funky architectures out there(RPi I'm looking at you[1]) so it's always worth understanding where the hardware constraints in your system can come back to cause havok.

[1] https://www.raspberrypi.org/documentation/configuration/conf...

fulafel3• 6 years ago

Why would it be impossible to have >1 chip access the SDRAM? Like Amiga did.

Especially if the GPU already had custom silicon for it.

Whether it would be good engineering (cost, time to market, risks) is of course another issue.

MrBuddyCasino2• 6 years ago

The only way to do this is to have one chip (It's always the GPU. The GPU needs more memory bandwidth) connected directly to the dram, and the second chip (CPU) has to send memory requests to the second chip.

I don't think thats true, in embedded architectures its not uncommon to have dual-port RAM.

drivebyubnt• 6 years ago

A 3 chip solution was very common for that era. See https://en.wikipedia.org/wiki/Northbridge_(computing)

The only unusual thing here is that the GPU and Northbridge are the same chip.

walrus01• 6 years ago

I still remember the "Xbox is HUGE" jokes from 2001.

crazysim• 6 years ago

Fun fact: The PS5 is huger than the Xbox!

joezydeco• 6 years ago

Bunnie Huang’s Hacking The Xbox is a great read, and it’s available as a free ebook:

https://bunniefoo.com/nostarch/HackingTheXbox_Free.pdf

TeaDude2• 6 years ago

I know nothing about the actual underlying architecture but from the (credible) sources I've heard from apparently it's a really nice API hiding an absolutely unholy mess and that's why emulation has been so poor for so long.

Aperocky• 6 years ago

it's a really nice API hiding an absolutely unholy mess

Aint that universal.

elcomet2• 6 years ago

If the API is nice, shouldn't the emulation be easy ? Since the emulator doesn't have to care about security / hacks.

Or do you mean that the API only nice in theory, but is actually not nice in practice (lot of undocumented corner cases, or bugs, that games might rely on) ?

TeaDude2• 6 years ago

I have no idea about the specifics but from what I've heard developers really liked the XBOX (despite it's unholy internals) so I'd say the API was actually nice.

As for HLE based on the API it's definitely possible but there's probably tons of nasty corner cases and that's my theory on why it's never been done. That and the chance of games with their own proprietary APIs existing and thus they won't work with that solution.

person_of_color• 6 years ago

For the Xbox 360, they ditched Intel and went for PowerPC. Microsoft then bought a bunch of PPC Mac Pros from Apple for development since they shared the same ISA :D

messe• 6 years ago

That entire generation of consoles, the Xbox 360, PS3 and Wii (and then arguably the Wii U) were all some form of PowerPC.

The following generation though everything switched to more commodity hardware, with the PS4 and Xbox One using x86_64 processors and the Switch using an almost off-the-shelf SoC from nvidia.

EDIT: Gamecube was also PPC.

loa_in_• 6 years ago

It is speculated that Microsoft may have left that code from prototype/debug units, so for the purposes of his research (possibly accidental, since this block exposes the types algorithms that Microsoft applied). In conclusion, this was considered garbage code [...]

I can't parse this excerpt

flipacholas2• 6 years ago

Fixed, thanks

MayeulC• 6 years ago

A few tidbits not included in the article:

* Some emulator do exists. The earlier attempts were just API translation layers that work a bit like wine: translate the function calls to native system APIs on windows. As time went, tricks and workarounds were piling up, especially as some games used lower level HW functionality (writing in registers, etc), which provided difficult to emulate, and game executables had to be patched, thus making the emulators a collection of special cases. Such emulators include Xenia, Cxbx (and derivatives such as shogun's version, dxbx, etc).

* More recently, efforts turned to low-level emulation, with complete emulation of the Xbox GPU, using a codebase derived from QEMU: XQEMU, and more recently XEMU (mborgeson's fork, focused on trying less-proven tricks and workarounds to maximize compatibility). Both are being developed in the open (XQEMU's development process might be slightly more open), and reverse-engineering is ongoing.

* There is also an ongoing effort to port ReactOS to both the Xbox and XQEMU (probably using the official nvidia NV2A driver): https://reactos.org/wiki/Install_ReactOS_on_Xbox

* Big names (among others) on the emulation scene: mborgeson, JayfoxRox, Espes, Shogun

* Bunnie Huang’s Hacking The Xbox was mentioned by another commenter, but 17 Mistakes Microsoft Made in the Xbox Security System is also an interesting read about working around the Xbox security mechanisms: https://xboxdevwiki.net/17_Mistakes_Microsoft_Made_in_the_Xb...

* I cannot stress enough how https://xboxdevwiki.net/ is a great resource for information. Other links: https://xqemu.com/ https://github.com/xqemu/xqemu/ https://xemu.app/ https://github.com/mborgerson/xemu/wiki#content-top https://shogun3d-cxbx.blogspot.com/

* There is a big discord community, some rooms are bridged with IRC on freenode, I also bridged #xqemu on Matrix: https://xboxdevwiki.net/Main_Page/Header

Xbox Architecture

Related Stories