Hacking the Xbox

242
Hacking the Xbox: An Introduction to Reverse Engineering
trouble adjusting to an HDL than a novice, because many software tricks
that are taken for granted translate very poorly to direct hardware
implementation. Arrays, structures, multiplication, and division primitives
are all taken for granted in the software world, but each of these
constructs translate to potentially large and inefficient blocks of hardware.
Furthermore, in a hardware implementation, all possible cases in a
case statement exist whether or not you intend for it; neglecting to fullyspecify
a case statement with a default case often means that extra
hardware will be synthesized to handle the implicit cases. Numerous
tutorials and syntax reference manuals for Verilog are indexed in Google;
Overclocking FPGA Designs
It is worth noting that the timing models used for an FPGA are
quite conservative. This means that it is quite likely that an
FPGA will operate properly at frequencies much higher than
the timing analyzer will admit. In fact, careful hand-layout of
an FPGA’s logic can stretch the performance of the FPGA much
further than its stated specifications.
For example, the FPGA (Xilinx Virtex-E) used to implement the
Xbox Hypertransport bus tap is only specified to handle data
rates of around 200 Mbits/s/pin, but the application demanded
400 Mbits/s/pin. The reason I could pull this off is that the actual
logic and storage elements can run very fast, but most of
the performance is burned off in the wires and repeaters that
carry the signals between logic elements. Specifically, some
wires will have so much delay at 400 Mbits/s that they effectively
store data for a single clock cycle.
I determined which wires were slower than the rest by capturing
a sequence of data and comparing it against a pattern
that I had previously discovered using an oscilloscope. Once
the slow paths were identified, I inverted the clock and/or inserted
flip-flops on channels that had too little delay. The end
result was a set of signals that were time-skew corrected. These
signals could then be trivially demultiplexed to a lower clock
rate where conventionally compiled HDL design techniques
could be used.
While this technique is very powerful, it is not generally applicable
because the amount of delay caused by a wire varies
from chip to chip and can depend on parameters such as
the ambient temperature and the quality of the power supply
voltage. However, for one specific chip under controlled circumstances,
I was able to get 2x the rated performance. Another
important difference between this application and a
more general application is that bit error rates on the order of
1 error in a few thousand was tolerable, since I could just take
three traces and XOR them to recover any information lost to
random noise sources. However, 1 in 10,000 bit error rates are
not acceptable for normal applications; unrecoverable error
rates better than 1 in 10,000,000,000,000 are more typical. This
all goes back to a saying that I have: “It is easy to do something
once, but doing something a million times perfectly is
hard.”