Kernel Architecture

​

Xbox 360 Kernel

• Base: Windows NT kernel (similar to Windows Server 2003)
• Modifications: Custom Xbox-specific functionality added
• Architecture: Monolithic kernel with loadable modules
• Modules: xboxkrnl.exe (kernel) and xam.xex (Xbox Application Manager)

​

High-Level Emulation (HLE)

• Emulates actual kernel machine code instruction-by-instruction
• Accurate but extremely slow
• Requires complete reverse engineering of kernel internals

• Implements kernel APIs as native functions
• Much faster than LLE
• Focuses on API behavior rather than implementation
• Requires understanding what each API does, not how it works

​

System Call Mechanism

​

Module Loading and Import Resolution

1. Game XEX is loaded - The executable format is parsed
2. Imports are found - Loader identifies all kernel imports (functions the game needs)
3. Syscall insertion - Loader places sc (syscall) instruction at import location
4. Export lookup - Kernel export is found and linked to the import
5. JIT code generation - JIT generates code to call Xenia’s export implementation

​

Syscall Execution

1. Guest code executes sc - System call instruction
2. JIT intercepts - Recognizes syscall and generates host call
3. Context transition - Switch from guest PowerPC context to host context
4. Export execution - Native C++ kernel function runs
5. Return value - Result placed in r3 register
6. Resume guest - Return to translated PowerPC code

​

Kernel Export Functions

​

Legacy SHIM_CALL Convention

SHIM_CALL XAudioGetSpeakerConfig_shim(
    PPCContext* ppc_context,
    KernelState* kernel_state
) {
  // Manually extract parameters from PowerPC registers
  uint32_t config_ptr = SHIM_GET_ARG_32(0);  // From r3
  
  // Implement functionality
  uint32_t config = CalculateSpeakerConfig();
  SHIM_MEM_32(config_ptr) = config;
  
  // Set return value
  SHIM_SET_RETURN_32(X_ERROR_SUCCESS);
}

• Provides direct access to PowerPC context
• Parameters are in r3-r10 (SHIM_GET_ARG_32)
• Additional params on stack
• Return value in r3 (SHIM_SET_RETURN_32)
• Used in older code, being phased out

​

Modern Template Convention

dword_result_t XAudioGetSpeakerConfig(
    lpdword_t config_ptr
) {
  // Parameters automatically extracted
  // config_ptr is already a typed pointer
  
  uint32_t config = CalculateSpeakerConfig();
  *config_ptr = config;
  
  // Return value automatically placed in r3
  return X_ERROR_SUCCESS;
}

• Uses templates to automate parameter extraction
• Type-safe parameter handling
• Automatic return value setting
• Cleaner, more maintainable code
• Preferred for new implementations

​

Kernel Modules

​

xboxkrnl.exe - Xbox Kernel

• Memory: NtAllocateVirtualMemory, MmAllocatePhysicalMemoryEx
• Threading: ExCreateThread, KeSetAffinityThread, NtWaitForSingleObject
• Synchronization: NtCreateEvent, NtCreateMutex, NtCreateSemaphore
• I/O: NtCreateFile, NtReadFile, NtWriteFile
• Modules: XexLoadImage, XexGetProcedureAddress
• Debugging: DbgPrint, KeBugCheck
• Audio: Low-level XAudio APIs
• Video: Display and video output APIs

• xboxkrnl_memory.cc - Memory management
• xboxkrnl_threading.cc - Thread and process management
• xboxkrnl_io.cc - File I/O and devices
• xboxkrnl_rtl.cc - Runtime library functions
• And more…

​

xam.xex - Xbox Application Manager

• User Management: Profiles, avatars, friends
• Achievements: Achievement unlocking and tracking
• Content: DLC, save games, marketplace
• UI: Dashboards, dialogs, keyboard input
• Networking: Xbox Live services
• Matchmaking: Multiplayer session management
• Storage: Save device management

class XamState {
  AppManager* app_manager_;              // Application lifecycle
  ContentManager* content_manager_;      // DLC and save data
  AchievementManager* achievement_manager_; // Achievements
  // ...
};

​

Kernel State

class KernelState {
  // Core subsystems
  Processor* processor_;               // CPU emulator
  Memory* memory_;                     // Memory manager  
  VirtualFileSystem* file_system_;     // VFS for game files
  XamState* xam_state_;                // XAM subsystem
  
  // Kernel objects
  ObjectTable* object_table_;          // Handle table
  std::vector<XThread*> threads_;      // All threads
  
  // Kernel globals
  KernelGuestGlobals* kernel_guest_globals_; // Guest-side structures
  
  // Processes
  X_KPROCESS idle_process_;            // Idle process
  X_KPROCESS title_process_;           // Game process
  X_KPROCESS system_process_;          // System process
  
  // ...
};

​

Kernel Guest Globals

struct KernelGuestGlobals {
  // Object types
  X_OBJECT_TYPE ExThreadObjectType;
  X_OBJECT_TYPE ExEventObjectType;
  X_OBJECT_TYPE ExMutantObjectType;
  // ... more object types
  
  // Processes
  X_KPROCESS idle_process;     // X_PROCTYPE_IDLE
  X_KPROCESS title_process;    // X_PROCTYPE_TITLE (game)
  X_KPROCESS system_process;   // X_PROCTYPE_SYSTEM
  
  // Locks
  X_KSPINLOCK dispatcher_lock; // Synchronization primitive lock
  X_KSPINLOCK ob_lock;         // Object manager lock
  
  // Events
  X_KEVENT UsbdBootEnumerationDoneEvent;
};

​

Object Management

​

Object Types

class XObject {
  X_HANDLE handle_;      // Kernel handle
  uint32_t ref_count_;   // Reference counting
  // ...
};

• XThread - Thread of execution
• XEvent - Event object (signaled/unsignaled)
• XMutant - Mutex (called “mutant” in NT kernel)
• XSemaphore - Semaphore
• XTimer - Timer object
• XFile - File handle
• XModule - Loaded executable module

​

Object Table

class ObjectTable {
  std::unordered_map<X_HANDLE, object_ref<XObject>> objects_;
  X_HANDLE next_handle_;
  
  X_HANDLE AddObject(XObject* object);
  XObject* LookupObject(X_HANDLE handle);
  void RemoveObject(X_HANDLE handle);
};

// Create event
X_HANDLE handle = NtCreateEvent(...);

// Wait on event  
NtWaitForSingleObject(handle, ...);

// Close handle
NtClose(handle);

​

Threading Model

​

Thread Creation

X_HANDLE ExCreateThread(
    lpdword_t handle_ptr,
    dword_t stack_size,
    lpdword_t thread_id_ptr,
    dword_t creation_flags,
    lpvoid_t start_address,
    lpvoid_t start_context,
    dword_t creation_params
);

1. Allocate XThread object
2. Create host thread (pthread or Windows thread)
3. Set up guest stack and context
4. Add to thread list in process
5. Return handle to caller

​

Thread Scheduling

• No emulation of Xbox 360 scheduler
• Relies on host to balance threads across cores
• Thread affinity can be set to pin to specific cores
• Priority levels are mapped to host priority levels

​

Thread Synchronization

• Manual or auto-reset
• Signaled/unsignaled state
• Wait functions block until signaled

• Recursive locking support
• Ownership tracking
• Priority inheritance

• Count-based synchronization
• Maximum count limit

• Lightweight spinlocks for short critical regions
• Implemented as tight loops checking atomic flags

​

Process Model

​

Idle Process (X_PROCTYPE_IDLE)

• Runs in interrupt contexts
• Initial kernel startup context
• Minimal functionality

​

Title Process (X_PROCTYPE_TITLE)

• The game itself
• Most game threads run in this process
• Has access to full system resources

​

System Process (X_PROCTYPE_SYSTEM)

• System background tasks
• Threads can be created with special flags
• Purpose not fully understood

​

File System

​

Device Mounting

GAME: -> Mounted disc image or folder
D:    -> Game partition
E:    -> Cache partition
HDD:  -> Hard drive

​

File Operations

X_HANDLE NtCreateFile(
    lpdword_t handle_out,
    dword_t desired_access,
    pointer_t<X_OBJECT_ATTRIBUTES> obj_attributes,
    // ... more params
);

X_STATUS NtReadFile(
    dword_t handle,
    lpvoid_t buffer,
    dword_t length,
    // ... more params
);

​

Debugging Support

​

Debug Print

void DbgPrint(
    const char* format,
    ... // varargs
);

​

Assertions

void KeBugCheck(dword_t code);
void KeBugCheckEx(dword_t code, ...);

​

Performance and Limitations

​

HLE Benefits

• Much faster than emulating kernel code
• Easier to implement and maintain
• Can use host OS facilities directly
• Focuses effort on game compatibility

​

HLE Challenges

• Requires reverse engineering each API
• Behavior must match original exactly
• Edge cases and undocumented behavior are difficult
• Some games may depend on kernel internals

​

Incomplete APIs

• Some are stubs that log warnings
• Rarely-used APIs may not be needed
• Implementation is driven by game requirements

​

References

• Kernel export implementations in src/xenia/kernel/xboxkrnl/
• XAM implementations in src/xenia/kernel/xam/
• Object management in src/xenia/kernel/util/object_table.h
• Kernel state in src/xenia/kernel/kernel_state.h