Platform and I O

Platform & I/O

The Xbox machine is not only a CPU plus NV2A. hw/xbox/xbox.c assembles a PC-derived platform around the NVIDIA nForce/MCPX chipset with PCI, AGP, LPC/ISA, SMBus, IDE, USB, networking, audio, timers, firmware and interrupt routing.

This page is the map for those non-GPU platform devices.

Platform topology

flowchart TD
    A[Pentium III guest CPU] --> B[System memory / I/O address spaces]
    B --> C[Xbox PCI host bridge]
    C --> D[LPC bridge]
    C --> E[SMBus controller]
    C --> F[IDE controller]
    C --> G[OHCI USB 0]
    C --> H[OHCI USB 1]
    C --> I[NVNet Ethernet]
    C --> J[MCPX APU]
    C --> K[MCPX ACI]
    C --> L[AGP bridge]
    L --> M[NV2A]

    D --> N[ISA bus]
    N --> O[PIC / PIT / RTC / DMA / PC speaker]

    E --> P[SMC]
    E --> Q[Video encoder]
    E --> R[Temperature / board sensors]

Loading

The diagram is architectural rather than a complete register-level wiring map. Device details live in their own source areas, but xbox_init_common() is the best single place to see how the machine is assembled.

Chipset model

hw/xbox/xbox_pci.c describes the Xbox chipset as based on the nForce 420 / AMD-760 family and models the broad split as:

• NV2A — northbridge/GPU side.
• MCPX — southbridge/audio/I/O side.

The implementation creates a root PCI bus, LPC bridge, SMBus function and AGP bridge, then the machine initialization attaches the other devices at Xbox-specific PCI slots.

PCI and AGP buses

xbox_pci_init() creates the PCI host bus and an Xbox-specific host bridge. It also creates a PCI memory hole alias above RAM so PCI mappings occupy the expected high physical-address region.

The AGP bridge is a secondary PCI bus used for NV2A.

CPU physical address space
    ↓
Xbox host bridge
    ├─ system RAM
    ├─ PCI MMIO / I/O windows
    ├─ LPC/ISA
    └─ AGP secondary bus
           ↓
          NV2A

This matters for debugging because a guest physical access can be consumed by RAM, a PCI BAR, an ISA I/O region, ROM, or an alias depending on address and current chipset state.

LPC and ISA

The Xbox LPC function creates an ISA bus and routes PCI/internal interrupt sources toward the legacy PIC.

Current modeled ISA/PC-compatible pieces include:

• i8259-compatible interrupt controller.
• PIT (i8254) timer.
• RTC (mc146818).
• i8257 DMA controller.
• PC speaker wiring through the PIT.

These devices are reused from QEMU's PC-compatible models where their behavior matches the Xbox platform closely enough.

Interrupt routing

The LPC model contains Xbox-specific mappings from PCI device slots/internal interrupt lines to PIC IRQs.

Representative internal mappings in xbox_pci.c include:

Device	Routed IRQ in current model
USB0	IRQ 1
USB1	IRQ 9
NVNet	IRQ 4
APU	IRQ 5
ACI	IRQ 6
IDE	IRQ 14
AGP bridge / NV2A path	PIRQ-routed

The guest-visible IRQ number is therefore a product of device interrupt state plus chipset routing; a device callback does not directly “call the CPU interrupt handler.”

For vCPU delivery semantics see CPU & vCPU Execution.

SMBus

The Xbox SMBus is modeled as an nForce/AMD756-like SMBus controller exposed as a PCI function.

The machine attaches board devices including:

• Xbox SMC at address 0x10.
• Video encoder selected by machine configuration:
  • Conexant CX25871.
  • Focus FS454.
  • Xcalibur.
• ADM1032 sensor on non-Xcalibur configurations.

The SMBus is important because guest software uses it for board-management functions that are outside the CPU/GPU core path.

System Management Controller

The SMC is attached to SMBus and represents Xbox board-management behavior such as machine state and AV-related configuration. The machine exposes configurable SMC version and AV pack values so software can observe appropriate platform state.

SMC behavior should be treated as guest hardware state rather than UI preference data: changes can affect what the guest reads from SMBus registers.

IDE / storage

The machine currently creates a PIIX3-style PCI IDE controller and attaches IDE devices through QEMU's storage infrastructure.

At a high level:

Guest ATA command
    ↓
PCI IDE device model
    ↓
QEMU block layer
    ↓
virtual HDD / optical backing storage

Storage performance or correctness investigations should distinguish ATA/device-model behavior from the block backend and host filesystem.

USB

Two PCI OHCI controllers are created, each configured with four ports.

Guest USB software
    ↓
OHCI controller state
    ↓
QEMU USB bus/device model
    ↓
Xbox controller / attached emulated USB device

This gives the platform eight modeled OHCI ports across the two controllers. Higher-level controller behavior belongs to the attached USB device implementation rather than the OHCI controller itself.

NVNet networking

The MCPX networking implementation lives under hw/xbox/mcpx/nvnet and is realized as the nvnet PCI device.

The network path bridges guest-visible NVNet device state into QEMU's networking backend:

Guest NVNet descriptors/registers
    ↓
NVNet device model
    ↓
QEMU network backend
    ↓
host networking

A networking bug can therefore exist in the guest NIC model, descriptor/DMA handling, QEMU network backend, or host network configuration. Keep those layers separate when tracing packets.

MCPX APU audio

Audio is modeled under hw/xbox/mcpx/apu.

The APU tree includes:

• Main APU device state/register handling.
• DSP implementation.
• Voice-processing (vp) implementation.
• Monitoring/debug/trace support.

The machine passes the Xbox RAM memory region into APU initialization, reflecting that audio processing can consume guest-memory-backed data rather than operating only on isolated registers.

A simplified flow is:

Guest audio state / buffers
    ↓
MCPX APU registers and DMA-visible data
    ↓
voice / DSP processing
    ↓
host audio output path

MCPX ACI

The machine also creates an mcpx-aci PCI function. It is maintained separately from the APU and NVNet device models under hw/xbox/mcpx/aci.c.

Treat PCI slot/function identity as part of the guest-visible platform contract even if a device currently implements only a subset of original hardware behavior.

Firmware and boot ROM

xbox_flash_init() constructs the BIOS/ROM mapping and MCPX boot-ROM overlay.

Important behavior includes:

• BIOS is mapped into the high physical-address ROM area.
• The image is mirrored through the expected top-of-address-space range.
• An optional 512-byte MCPX boot ROM is overlaid near the top of the BIOS image.
• The LPC chipset can disable the MCPX ROM overlay during boot through configuration state.

The current implementation deliberately makes the MCPX overlay writable while active to emulate a retail-kernel cache-dependent boot quirk that cannot be represented accurately with the host CPU cache model.

This is a good example of an emulator implementation detail that exists to preserve guest-observed behavior, not to mirror the physical electrical implementation literally.

ACPI / power-management path

Xbox-specific ACPI/power-management support is wired through the LPC function. xbox_pci.c allocates ACPI interrupt routes and initializes the Xbox power-management device state.

Power-management state participates in the same interrupt and migration/lifecycle constraints as other guest devices.

Physical wiring versus logical devices

xemu models the logical result of most motherboard wiring rather than individual electrical nets.

flowchart LR
    A[Physical pin / trace / bus] -->|Xbox hardware| B[Chip internal logic]
    B --> C[register / IRQ / DMA result]

    D[Guest I/O / MMIO] -->|xemu| E[QEMU MemoryRegion/device callback]
    E --> C

Loading

The LPC debug footprint, for example, physically carries LAD[3:0], LFRAME#, LRESET#, LCLK and SMBus SCL/SDA. xemu exposes PCI/LPC/SMBus behavior through QEMU bus/device abstractions rather than toggling software objects for every pin edge.

PC speaker

The real MCPX exposes a PC-speaker signal at pin L21, but the stock motherboard has no speaker connected to it. xbox_init_common() nevertheless links QEMU's pcspk object to the PIT and realizes it on the ISA bus. xemu therefore models the logical interface and makes it host-observable even though the retail console's signal is normally inaudible without a soldered speaker.

See Hardware Fidelity & Emulation Boundaries for the physical-versus-emulated flow.

Known platform shortcuts/gaps

Area	Current boundary
SMBus	Transactions execute synchronously; no bit-level wire timing
SMC	Semantic PIC-facing register/event model; many fan/LED/eject writes remain no-op
GPIO field pin	Toggles on each read instead of following raster/encoder timing
ADM1032	Implemented temperature reads return fixed 50
Conexant/Focus/Xcalibur	Primarily 256-byte register façades
Memory controller	Explicit pci-testdev stub
APU	Dedicated worker paced partly by host SDL audio queue; includes immediate “magic” notify write
NVNet	Descriptor/DMA NIC with logical PHY; analog Ethernet not modeled
XID	USB protocol is modeled; several unsupported request paths still assert in assertion-enabled builds

Detailed platform pages

• Board Management: SMBus, SMC & GPIO
• MCPX APU & Audio
• NVNet Networking
• USB, OHCI & XID Input
• Firmware, Boot & ROM
• Hardware Fidelity & Emulation Boundaries

Device state and snapshots

Each emulated device can have:

• Guest-visible registers.
• Internal derived state.
• Timers.
• DMA pointers/descriptors.
• IRQ state.
• Host backend state.

Snapshot/restore should serialize enough guest/device state to reconstruct correct behavior without serializing host resource identities directly.

For timing-specific lifecycle see Clocks & Timers. For graphics host-resource lifecycle see NV2A Graphics Architecture.

Source map

Source	Responsibility
hw/xbox/xbox.c	Overall machine construction, RAM/ROM, IDE, USB, NVNet, APU, ACI, NV2A and SMBus devices
hw/xbox/xbox_pci.c	PCI host/LPC/SMBus/AGP buses, PCI hole and interrupt routing
hw/xbox/acpi_xbox.c	Xbox power-management / ACPI behavior
hw/xbox/amd_smbus.c	SMBus controller implementation
hw/xbox/smbus_*	SMC, sensor and video-encoder devices
hw/xbox/mcpx/apu/*	MCPX audio/APU, DSP and voice-processing implementation
hw/xbox/mcpx/nvnet/*	MCPX Ethernet implementation
hw/xbox/mcpx/aci.c	MCPX ACI PCI function
hw/xbox/nv2a/*	NV2A GPU/device implementation

PFIFO MMIO measurement candidate

PFIFO Constant Status Read documents the narrow current-model NV_PFIFO_RUNOUT_STATUS lock-bypass hypothesis. It is explicitly not evidence that the physical hardware register is universally constant.

Related pages

• System Architecture
• Memory & DMA
• CPU & vCPU Execution
• Clocks & Timers
• NV2A Graphics Architecture